Support MySQL 5.7.19 by mysql/slowlog

[kvch]

• Make mysql.slowlog.host optional.
• Rename @timestamp to read_timestamp before transforming logs timestamp.

Output of pipeline tester:

$ ./scripts/tester/execute_pipeline --pipeline "module/mysql/slowlog/ingest/pipeline.json" \
--log '# User@Host: root[root] @  [172.17.0.11]  Id:     5
# Query_time: 0.000100  Lock_time: 0.000033 Rows_sent: 101  Rows_examined: 101
SET timestamp=1524768632;
SELECT intcol1,charcol1 FROM t1;
# Time: 2018-04-26T18:50:32.437295Z' \
--verbose
{
  "docs": [
    {
      "doc": {
        "_id": "id",
        "_index": "index",
        "_ingest": {
          "timestamp": "2018-04-27T20:06:01.986Z"
        },
        "_source": {
          "@timestamp": "2018-04-26T18:50:32.000Z",
          "mysql": {
            "slowlog": {
              "id": "5",
              "ip": "172.17.0.11",
              "lock_time": {
                "sec": "0.000033"
              },
              "query": "SELECT intcol1,charcol1 FROM t1;\n# Time: 2018-04-26T18:50:32.437295Z",
              "query_time": {
                "sec": "0.000100"
              },
              "rows_examined": "101",
              "rows_sent": "101",
              "timestamp": "1524768632",
              "user": "root"
            }
          },
          "read_timestamp": "2018-04-27T20:06:01.974Z"
        },
        "_type": "doc"
      }
    }
  ]
}

Closes #6882
Closes #6492

[ruflin]

Is this a breaking change?

[kvch]

Indeed.

[kvch]

@ruflin I have removed the breaking change from the pipeline. It would be nice to add read_timestamp and transform @timestamp in all pipelines. But it should be done in one batch and release it in 7.0.

[ruflin]

@kvch Agree that we should come up with a convention for read_timestamp/@timestamp across all modules and do it in one go. Perhaps there are also other solutions then only breaking change. Lets discuss this further.