[filebeat] In Filebeat, when using the move_fields processor with the ignore_missing: true setting to ignore missing keys, it doesn't work as expected

Elastic Stack Beats
1

In Filebeat 8.10.2, when using the move_fields processor with the ignore_missing: true setting to ignore missing keys, it doesn't work as expected. Instead of ignoring the missing field and continuing the processing, an error is thrown when the field doesn't exist in the log.

The move_fields processor is designed to rename or move fields within a document. When using the ignore_missing parameter set to true, it should ignore cases where the source field doesn't exist and continue with the rest of the processing pipeline.

Dingtalk_20231008160732
Dingtalk_202310081607321132×682 156 KB

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.