Can't use variables in containing a slash in elastic-agent configuration

Elastic Stack Beats
,
1

I'm trying to define a condition in an elastic-agent configuration where the variable contains a slash, e.g.:

        streams:
          - id: >-
              filestream-kubernetes.container_logs-catchall
            data_stream:
              type: logs
              dataset: kubernetes.container_logs
            condition: "${kubernetes.node.labels.beta_kubernetes_io/arch} == 'amd64'"
            paths:
              - '/var/log/containers/*${kubernetes.container.id}.log'
            prospector.scanner.symlinks: true
            parsers:
              - container:
                  stream: all
                  format: auto

This leads to an error in the elastic-agent

{"log.level":"error","@timestamp":"2022-06-10T15:32:23.105Z","log.origin":{"file.name":"emitter/controller.go","file.line":123},"message":"Failed to render configuration with latest context from composable contro
ller: condition \"${kubernetes.node.labels.beta_kubernetes_io/arch} == 'amd64'\" evaluation failed: error in while parsing the expression ${kubernetes.node.labels.beta_kubernetes_io/arch} == 'amd64', error interf
ace conversion: interface {} is nil, not bool","ecs.version":"1.6.0"}

Variables without a slash are fine. This field is accessible in Kibana EQL and as a condition in my earlier filebeats setup

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.