Determine if field containing special characters in name is not null in Elasticsearch ingest pipeline

Elastic Stack Elasticsearch
1

I'm monitoring a set of pods using elastic-agent which have labels which resolve to the following format when ingested:

kubernetes.labels.foo_bar/baz: value

I need to do something in Elasticsearch ingest pipeline if this field is present. For labels without special characters (e.g., kubernetes.labels.env), the following statement works:

{
    ...
    if: "ctx?.kubernetes?.labels?.env != null"
}

However, this does not work for label values which contain special characters, such as /-. How can I make this work?

2

I was able to figure this out this morning. The if statement is:

ctx?.kubernetes?.labels != null && ctx.kubernetes.labels.containsKey('foo_bar/baz')
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.