I'm trying to use Kubernetes annotations to instruct filebeat how my logs should be processed.
But so far I was lucky with the dissect and timestamp processors only.
Nor rename, neither drop_fileds are not working for me.
I guess this is due to both of them expecting an array as input. But what is the correct format to pass array of fields as an annotation value?
for drop_filed, I'm constantly getting:
error creating runner from config: can not convert 'string' into 'object' accessing 'processors.2.drop_fields'
I'm using Filebeat 7.3.2