From fdc8a60a9659c38efa63449de7af182f6a9e2c64 Mon Sep 17 00:00:00 2001 From: Tiago Queiroz Date: Thu, 6 Feb 2025 10:20:27 -0500 Subject: [PATCH] Add conditions to copy_fields processor This commit adds conditions to the `copy_fields` processor from the monitoring Filebeat to prevent it from failing and spamming the event logger at debug level with: `target field xxx already exists, drop or rename this field first` --- .../application/monitoring/v1_monitor.go | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/internal/pkg/agent/application/monitoring/v1_monitor.go b/internal/pkg/agent/application/monitoring/v1_monitor.go index 55e9a4dc3f9..bb3bd43a487 100644 --- a/internal/pkg/agent/application/monitoring/v1_monitor.go +++ b/internal/pkg/agent/application/monitoring/v1_monitor.go @@ -424,6 +424,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components [] "to": "data_stream.dataset_original", }, }, + "when": map[string]any{ + "not": map[string]any{ + "has_fields": []any{ + "data_stream.dataset_original", + }, + }, + }, }, }, // drop the dataset field so following copy_field can copy to it @@ -443,6 +450,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components [] "to": "data_stream.dataset", }, }, + "when": map[string]any{ + "not": map[string]any{ + "has_fields": []any{ + "data_stream.dataset", + }, + }, + }, "fail_on_error": false, "ignore_missing": true, }, @@ -450,6 +464,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components [] // possible it's a log message from agent itself (doesn't have component.dataset) map[string]interface{}{ "copy_fields": map[string]interface{}{ + "when": map[string]any{ + "not": map[string]any{ + "has_fields": []any{ + "data_stream.dataset", + }, + }, + }, "fields": []interface{}{ map[string]interface{}{ "from": "data_stream.dataset_original", @@ -471,6 +492,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components [] // update event.dataset with the now used data_stream.dataset map[string]interface{}{ "copy_fields": map[string]interface{}{ + "when": map[string]any{ + "not": map[string]any{ + "has_fields": []any{ + "event.dataset", + }, + }, + }, "fields": []interface{}{ map[string]interface{}{ "from": "data_stream.dataset",