Filebeat processor help

Elastic Stack Beats
1

Hey i need some help with filebeat processors. I want to decode_json_fields if the kubernetes.container.name is equal to 1 or more values.

   processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - decode_json_fields:
          when:
            equals:
              kubernetes.container.name: "entity-extractor-api-prod"
          fields: ["message"]
          process_array: false
          max_depth: 10
          target: "log"
          overwrite_keys: true
          add_error_key: true

Is it possible to set an array here?

when:
  equals:
    kubernetes.container.name: ["app1", "app2"]
2

Unfortunately, you cannot set an array. However, you can still accept the two names at the same time by using the or conditional:

when:
  or:
  - equals:
      kubernetes.container.name: "app1"
  - equals:
      kubernetes.container.name: "app2"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.