[12:28:19] <claime>	 _joe_: cwhite: https://logstash.wikimedia.org/goto/32b09076e6c9a452c2a8722aa37967b8  < we got logs \o/
[12:37:31] <akosiaris>	 \o/
[13:14:33] <claime>	 How complicated would it be to not strip a custom field from messages that go in the ecs index?
[13:14:46] <claime>	 "normalized.dropped.no_such_field
[13:14:48] <claime>	  normalized_message, timestamp, kubernetes
[13:14:56] <claime>	 I'd like to at least not get my kube info dropped :p
[13:15:51] <claime>	 (apart from labels, if can avoid it)
[13:19:04] <claime>	 Oooh, orchestrator fields
[13:19:06] <claime>	 let's go
[14:15:42] <claime>	 Just fmi, is there a way to know in which version certain ECS fields have been introduced?
[14:15:59] <claime>	 (I've for the moment resorted to bumping all versions to the latest)
[15:47:03] <cwhite>	 claime: upstream's changelog https://github.com/elastic/ecs/blob/main/CHANGELOG.md combined with our own changelog https://gerrit.wikimedia.org/r/plugins/gitiles/operations/software/ecs/+/refs/heads/master/changelog
[15:48:41] <claime>	 cwhite: Thanks, so I was right to update, because orchestrator is 1.10 and we were doing 1.7. Cool.
[15:48:48] <claime>	 s/update/bump/
[15:58:06] <claime>	 Thanks for the reviews ;)
[15:58:55] <cwhite>	 Glad to help!