Add_field processor on empty env provider fields stop ingest

Elastic Stack Beats
1

Hi,

Our nodes have some attributes to define what asset they belong to (environment, application, component). With migrating to agent these fields got lost and we have utilized the environment provider and the add_fields processor to re-add them and notices some weird behavior.

The processor is configured like this for all of the integrations:

- add_cloud_metadata: ~
- add_host_metadata:
    netinfo.enabled: true
    cache.ttl: 10m
- add_fields:
    target: ''
    fields:
        envcode: "${env.envcode}"
        appcode: "${env.appcode}"
        cmpcode: "${env.cmpcode}"

If even one of the environment variables doesn't exist (for whatever reason) the data ingest stops.
No more events are coming in on elasticsearch.

We're unsure of what exactly happens as agent is not logging any errors/warnings in these instances.

p.s having to configure these processors for every integration instead of on policy level is not ideal (hint hint)

Regards
Stijn

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.