Unable to use rename processor

Elastic Stack Beats
1

I am trying to use the rename processor in Filebeat 6.4.2 like this:

    processors:
      - rename:
        fields:
          - from: "app.kubernetes.io/name"
            to: "app"
          - from: "app.kubernetes.io/part-of"
            to: "part.of"
        ignore_missing: true
        fail_on_error: false

However with this configuration filebeats fails to start up, with the error:

Exiting: error unpacking config data: required 'object', but found 'bool' in field 'processors.0.ignore_missing' (source:'/etc/filebeat.yml')

Not sure why filebeat thinks ignore_missing is an object type rather than boolean.

2

Hi @rocketraman,

You need to add an indentation level to your rename processor settings, also take into account that you need to use the full field name in from:

    processors:
      - rename:
          fields:
            - from: "kubernetes.labels.app.kubernetes.io/name"
              to: "app"
            - from: "kubernetes.labels.app.kubernetes.io/part-of"
              to: "part.of"
          ignore_missing: true
          fail_on_error: false
3

@jsoriano I think that might have been the only indentation variation I didn't try, lol :slight_smile: It still doesn't work but at least the config is being parsed now. I'll post in my other thread about the remaining issues.