[FLUME-2838] Syslog Sinks use 'flume.syslog.status' header which breaks in ElasticSearch 2.0

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.6.0
• Component/s: Sinks+Sources
• Assignee: Unassigned
• Reporter: Matt Wise
• Created: 06/Nov/15 19:54
• Updated: 06/Nov/15 20:49

Description

The EVENT_STATUS header is written to a header named 'flume.syslog.status' – this header works fine in Flume itself, but breaks in ElasticSearch: https://www.elastic.co/guide/en/elasticsearch/reference/2.0/_mapping_changes.html#_field_names_may_not_contain_dots

The offending code is here: https://github.com/apache/flume/blob/67ed62aa18df3675b68369d0d00c8f0dcbdfb970/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java#L92 (And in a few other places)

This should be easily fixable by renaming the field to 'Status' – which is more in-line with the rest of the fields there anyways.