Cannot rename sub-fields of cloud metadata added via add_cloud_metadata

I'm unable to rename sub-fields of the cloud field added via add_cloud_metadata.

In particular, this configuration results in missing fields for,, etc:

  - add_cloud_metadata: ~
  - rename:
        - from: ""
          to: ""
        - from: "cloud.availability_zone
          to: ""
        - from: "cloud.region"
          to: "serverId.datacenter.region"
        - from: "cloud.provider"
          to: "serverId.datacenter.provider"
      ignore_missing: true

What's even more odd is that the original fields under cloud are removed from the output. In the case of, we're left with cloud.instance: {}.

If we remove the ignore_missing flag, we end up with an error about missing fields. What's odd is that drop_fields appears to work fine and can drop sub-fields of cloud. Also, renaming the top-level cloud field works fine.

For example, this works:

  - add_cloud_metadata: ~
  - drop_fields:
      fields: ["cloud.image", "cloud.machine", "cloud.account"]
  - rename:
        - from: "cloud"
          to: ""

I'm using journalbeat 7.3.2, but I don't believe this issue is specific to journalbeat.

I'm also able to rename sub-fields of the host field added by add_host_metadata just fine. This issue appears to be specific to add_cloud_metadata.

Comparing to, could the issue be with the lack of cloning the underlying metadata fields?

The issue did seem to be the lack of Clone-ing the injected map.

Posted a PR:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.