Hi Team,
I want to create a new field called kubernetes.pod.name if fields called prometheus.labels.pod exists in the logs. I found out that from the set processor I could copy the value which is present in prometheus.labels.pod to a new field kubernetes.pod.name but I need to do this conditionally as the pod name keeps on changing.
How do i set a condition such that if field prometheus.labels.pod exists then only I need to add a new field called kubernetes.pod.name (both has the same value)
What exactly does your data look like? The above example works if it's formatted like this.
"_source": {
"prometheus.labels.pod": "test"
}
I don't think ctx?.prometheus?.labels?.pod!=null will work. The ctx.containsKey('prometheus.labels.pod') checks to see if the field exists and I think that's what you are looking for.
I don't know the answer yet, might require another processor. But the issue is you have an array based on your last message. I thought it was a string before.
So if you run the below in dev tools you will see one of the 2 messages will be true on the condition and it will create a new field but I am not sure you can target the first array element. Is there always only one value in the array? If there is 2 values then which do you use?
Also if you were just checking to see if the field was null or empty then records without that field would return true and it would create a new field with no value.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.