I deploy the stand-alone elastic agent using the following
(Run Elastic Agent standalone on Kubernetes | Fleet User Guide [7.14] | Elastic).
if the pods are labeled or annotated by labels with . in their name. it will break.
it seems in order to cover this use case, the dodot functionality was added in filebeat, but there is no way to configure it in the elastic agent.
[
elastic_agent.filebeatfilebeat-json.log
][warn] Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc03d6b5fe0269493, ext:2361610274600,
loc:(*time.Location)(0x5576497ef2a0)}, Meta:{"raw_index":"logs-container-default"}, Fields:
{"agent":{"ephemeral_id":"c255a32b-65aa-4be1-aa2d-15c0330c10c7","hostname":"ip-10-3-1-85.eu-west-1.compute.internal","id":"4ac41a4c-9077-48d5-81fb-c7425a76a34a","name":"ip-10-3-1-85.eu-west-1.compute.internal","type":"filebeat","version":"7.14.0"},"cloud":{"account":{"id":"xxxxxx"},"availability_zone":"eu-west-1a","image":{"id":"ami-xxxxx"},"instance":{"id":"i-xxxx"},"machine":{"type":"m5.2xlarge"},"provider":"aws","region":"eu-west-1","service":{"name":"EC2"}},"data_stream":{"dataset":"container","namespace":"default","type":"logs"},"ecs":{"version":"1.10.0"},"elastic_agent":{"id":"4ac41a4c-9077-48d5-81fb-c7425a76a34a","snapshot":false,"version":"7.14.0"},"event":{"dataset":"container"},"host":{"architecture":"x86_64","containerized":true,"hostname":"ip-10-3-1-85.eu-west-1.compute.internal","id":"bb43eb848699cf59adb70cc299cb4597","ip":["10.3.1.85","fe80::4b8:55ff:fee8:1b03","10.3.1.160"],"name":"ip-10-3-1-85.eu-west-1.compute.internal","os":{"codename":"Core","family":"redhat","kernel":"4.14.232-177.418.amzn2.x86_64","name":"CentOS Linux","platform":"centos","type":"linux","version":"7 (Core)"}},"input":{"type":"log"},"kubernetes":{"container":{"id":"15c9590f50c0ef82bf79f792dcd09c1cae162ca171a84612ef7b0be40c49b9f4","image":"docker.elastic.co/beats/elastic-agent:7.14.0","name":"elastic-agent","runtime":"docker"},"namespace":"elastic-system","pod":{"ip":"10.3.1.85","labels":{"app":"elastic-agent","controller-revision-hash":"84777585d7","pod-template-generation":"4"},"name":"elastic-agent-cbbz9","uid":"ad199031-fe74-4812-9be2-a792c00a860f"}},"log":{"file":{"path":"/var/log/containers/elastic-agent-cbbz9_elastic-system_elastic-agent-15c9590f50c0ef82bf79f792dcd09c1cae162ca171a84612ef7b0be40c49b9f4.log"},"offset":46915},"message":"{\"log\":\"2021-08-12T14:53:50.870Z\\u0009INFO\\u0009application/periodic.go:101\\u0009No configuration change\\n\",\"stream\":\"stderr\",\"time\":\"2021-08-12T14:53:50.870498824Z\"}"},
Private:file.State{Id:"native::117529023-66305", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000e35380), Source:"/var/log/containers/elastic-agent-cbbz9_elastic-system_elastic-agent-15c9590f50c0ef82bf79f792dcd09c1cae162ca171a84612ef7b0be40c49b9f4.log", Offset:47082, Timestamp:time.Time{wall:0xc03d6911c3a294c1, ext:1131861943, loc:(*time.Location)(0x5576497ef2a0)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x70159bf, Device:0x10301}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}}
(status=400): {"type":"mapper_parsing_exception",
"reason":"object mapping for [kubernetes.pod.labels.app] tried to parse field [app] as object, but found a concrete value"}
is there a way to dedot the labels and annotation?
Thanks
Elasitc agent Kubernetes provider : Variables and conditions in input configurations | Fleet User Guide [7.14] | Elastic
Filebeat Kubernetes provider: Autodiscover | Filebeat Reference [7.14] | Elastic