added capability to use elasticsearch datastreams

[applike-ss]

This should fix #17, however i am aware that the solution is nowhere near good.

However since i wasted roughly 6 hours on this small issue and how to resolve it (thanks to the great way bitnami builds their images and how this software is built - which doesnt seem to work since after the vendor update anymore via th dockerfile).

Consider this as "where to add the missing field" data wise and not as "should be merged" code.

Please take note that this is a copy if this PR opsgenie#165
Also i did not test it with this repositories most recent version of the software

[mustafaakin]

Thanks for input. I'm not familiar with Datastreams. However, if all we need is a filename called timestamp, we should handle it within elasticsearch sink somehow.

[applike-ss]

With filename you likely mean a property on the object, because that is what it is.

Your suggestions seems to imply that we'd marshal the *kube.EnhancedEvent, then unmarshal it into a map[string]any to add the timestamp field and then marshal it again for sending to ES, is that correct?

The only other way i can imagine is adding a EsEnhancedEvent struct which wraps the *kube.EnhancedEvent and then add the timestamp field on that one. That solution i'd actually prefer here.

What do you think?

[applike-ss]

Closing without comment? How about explaining why? I'm fine with it if it was implemented already, but if it wasn't then maybe respond to my prior message instead of closing.

[mustafaakin]

Sorry. We should not change the kube.EnhancedEvent just for the Elasticsearch sink. The config of Elasticsearch should take "datastreams: true" and it's own method should handle adding a timestamp value to that. Otherwise it'd effect all sinks.

[applike-ss]

We're moving away from kubernetes-event-exporter to a different solution, so i will not update this PR anymore. Anyone who likes, feel free to create a new PR.