How do we convert the following filebeat config into kubernetes pod annotation level.
processors:
- decode_json_fields:
fields: ["message","msg"]
target: "qrapp"
add_error_key: true
kubernetes pod annotation
co.elastic.logs/processors.decode_json_fields.fields: ["message","msg"]
co.elastic.logs/processors.decode_json_fields.target: "qrapp"
co.elastic.logs/processors.decode_json_fields.add_error_key" 'true'
Doubt is on co.elastic.logs/processors.decode_json_fields.fields: ["message","msg"] this.
Looks ok apart from a typo:
co.elastic.logs/processors.decode_json_fields.add_error_key: 'true'
Also the field is message. Do you need the msg?
co.elastic.logs/processors.decode_json_fields.fields: 'message'
co.elastic.logs/processors.decode_json_fields.target: "qrapp"
co.elastic.logs/processors.decode_json_fields.add_error_key: 'true'
is ok, but is it ok to declare as string "message" because as per the url Decode JSON fields | Filebeat Reference [8.8] | Elastic "fields" is array type.
Yes there is no problem.
Used this annotations in my dummy nginx pod:
annotations:
co.elastic.logs/processors.decode_json_fields.fields: 'message'
co.elastic.logs/processors.decode_json_fields.target: "qrapp"
co.elastic.logs/processors.decode_json_fields.add_error_key: 'true'
And see the result:
Mind that this is the json entry I create in my message field:'{"test":"hello"}'
system
July 4, 2023, 3:39pm
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
