In Filebeat 8.10.2, when using the
move_fields processor with the
ignore_missing: true setting to ignore missing keys, it doesn't work as expected. Instead of ignoring the missing field and continuing the processing, an error is thrown when the field doesn't exist in the log.
move_fields processor is designed to rename or move fields within a document. When using the
ignore_missing parameter set to
true, it should ignore cases where the source field doesn't exist and continue with the rest of the processing pipeline.