Exception: Key 'my_field' found in event is not documented!

[Jim_Ivey]

I'm getting this error in testing my module: Exception: Key 'my_field' found in event is not documented!

Mr. Google only finds discussion in github about PRs related to this. I don't know what this error means.

Here's an excerpt from filebeat/module/my_module/_meta/fields.xml:

- key: my_module
  title: "Jim's new module"
  description: >
    This is the module Jim is trying to create.
  fields:
    - name: my_fileset
      type: group
      fields:
        - name: my_field
          description: Please add description
          example: Please add example
          type: text
...

In addition, I have this in filebeat/module/my_module/my_fileset/_meta/fields.xml:

- name: my_fileset
  description: >
    This is a fileset in Jim's fancy new module.
  example: Please add example
  type: group
  fields:
  - name: my_field
    description: Please add description
    example: Please add example
    type: text
...

Shouldn't that be enough to document the field?

For context, I'm testing just this module in the manner described here: Debugging test.log-expected.json

Thanks in advance!

[ChrsMark (Chris Mark)]

Hi @Jim_Ivey!

Most probably you need to run a make update command inside filebeat folder. This collects all the fields from the different modules and creates a final fields.yml in which tests are looking for the under-test fields. Let me know if this helps.

C.

[Jim_Ivey]

Thanks. I've run make update and verified that these fields are in filebeat/fields.yml as well as filebeat/module/my_module/fileset/_meta/fields.yml. It's not in filebeat/module/my_module/_meta/fields.yml. It was there, but that led to duplicate declarations in filebeat/fields.yml.

Given that the field is already declared in the places you suggest, I'll assume it's a bug and see if I can fix it. Thanks!

[Jim_Ivey]

I figured it out. My ingest/pipeline.json and test/test.log-expected.json referred to the fields without the my_module.my_fileset. prefix.

Honestly, I still don't completely understand where the module/fileset prefix is needed and where it's inferred. I was looking at the apache module as an example and they seem to prefix only some fields. I don't know why.

Thanks!