Skip to content

Commit

Permalink
Add conditions to copy_fields processor
Browse files Browse the repository at this point in the history
This commit adds conditions to the `copy_fields` processor from the
monitoring Filebeat to prevent it from failing and spamming the event
logger at debug level with:
`target field xxx already exists, drop or rename this field first`
  • Loading branch information
belimawr committed Feb 6, 2025
1 parent 345f2ae commit fdc8a60
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions internal/pkg/agent/application/monitoring/v1_monitor.go
Original file line number Diff line number Diff line change
Expand Up @@ -424,6 +424,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
"to": "data_stream.dataset_original",
},
},
"when": map[string]any{
"not": map[string]any{
"has_fields": []any{
"data_stream.dataset_original",
},
},
},
},
},
// drop the dataset field so following copy_field can copy to it
Expand All @@ -443,13 +450,27 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
"to": "data_stream.dataset",
},
},
"when": map[string]any{
"not": map[string]any{
"has_fields": []any{
"data_stream.dataset",
},
},
},
"fail_on_error": false,
"ignore_missing": true,
},
},
// possible it's a log message from agent itself (doesn't have component.dataset)
map[string]interface{}{
"copy_fields": map[string]interface{}{
"when": map[string]any{
"not": map[string]any{
"has_fields": []any{
"data_stream.dataset",
},
},
},
"fields": []interface{}{
map[string]interface{}{
"from": "data_stream.dataset_original",
Expand All @@ -471,6 +492,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
// update event.dataset with the now used data_stream.dataset
map[string]interface{}{
"copy_fields": map[string]interface{}{
"when": map[string]any{
"not": map[string]any{
"has_fields": []any{
"event.dataset",
},
},
},
"fields": []interface{}{
map[string]interface{}{
"from": "data_stream.dataset",
Expand Down

0 comments on commit fdc8a60

Please sign in to comment.