Empty fields appear in InfluwDB filled with the variable name, i.e. %{[kubernetes_node_name]}

In InfluxDB output plugin configured with:
data_points => {
"_kubernetes_namespace" => "%{[kubernetes_namespace]}"
"_field_env" => "%{[field_env]}"
"_event_dataset" => "%{[event_dataset]}"
"_kubernetes_pod_name" => "%{[kubernetes_pod_name]}"
"_kubernetes_container_name" => "%{[kubernetes_container_name]}"
"_kubernetes_node_name" => "%{[kubernetes_node_name]}"
}

I get the output:

select * from K8S_E4_V2 limit 10
name: K8S_E4_V2
time _event_dataset _field_env _kubernetes_container_name _kubernetes_namespace _kubernetes_node_name _kubernetes_pod_name


1583761536000000000 system.cpu caa %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536275000000 system.load caa-hors-prod %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536276000000 system.cpu caa-hors-prod %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536556000000 system.load caa-hors-prod %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536575000000 kubernetes.system caa %{[kubernetes_container_name]} %{[kubernetes_namespace]} worker-002 %{[kubernetes_pod_name]}
1583761536576000000 system.process caa %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536577000000 kubernetes.container caa argo-operator kube-system worker-002 argo-operator-deployment-7fcccb6d6d-k5sc6
1583761536579000000 kubernetes.volume caa %{[kubernetes_container_name]} caci-e4-production worker-002 communication-e4-prd-c98f9dfb-bmj9r
1583761536582000000 system.socket caa %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}
1583761536781000000 system.load caa %{[kubernetes_container_name]} %{[kubernetes_namespace]} %{[kubernetes_node_name]} %{[kubernetes_pod_name]}

that means that empty fields are filled with the variable name.
I tried to prevent this of occuring with different ways, but none is actually working:

if [field][env] == "" {
#mutate { remove_field => ["field_env"] }
mutate { copy => { "NULL" => "%{[field_env]}" } }
#mutate { remove_field => ["%{field_env}"] }
}
if ![event][dataset] {
#mutate { remove_field => ["event_dataset"] }
mutate { copy => { "NULL" => "%{[event_dataset]}" } }
#mutate { remove_field => ["%{event_dataset}"] }
}
if ![kubernetes][pod][name] {
#mutate { remove_field => ["kubernetes_pod_name"] }
mutate { copy => { "NULL" => "%{[kubernetes_pod_name]}" } }
#mutate { remove_field => ["%{kubernetes_pod_name}"] }
}
if ![kubernetes][container][name] {
#mutate { remove_field => ["kubernetes_container_name"] }
mutate { copy => { "NULL" => "%{[kubernetes_container_name]}" } }
#mutate { remove_field => ["%{kubernetes_container_name}"] }
}
if ![kubernetes][node][name] {
#mutate { remove_field => ["kubernetes_node_name"] }
mutate { copy => { "NULL" => "%{[kubernetes_node_name]}" } }
#mutate { remove_field => ["%{kubernetes_node_name}"] }
}

How can I prevent the empty field to appear in output as the variable name ???

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.