Journalbeat container.image output incompatible with ECS

Elastic Stack Beats
1

Using Journalbeat, logstash and elasticsearch version 7.6.0 we are getting bulk indexing errors due to an incompatibility with the ECS schema

Journalbeat appears to be outputting container.image as a concrete value whereas ecs defines it as object with 2 fields - container.image.name and container.image.tag

Is this a known issue ?

2

Hey @bbailey,

Thanks for reporting this. Could you please share the configuration you are using in journalbeat, and an example event with the container.image field?

3

No problem, I'll see what I can share with you tomorrow.

4

This is opened as an issue in github now

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.