Skip to content

Commit fdc8a60

Browse files
committed
Add conditions to copy_fields processor
This commit adds conditions to the `copy_fields` processor from the monitoring Filebeat to prevent it from failing and spamming the event logger at debug level with: `target field xxx already exists, drop or rename this field first`
1 parent 345f2ae commit fdc8a60

File tree

1 file changed

+28
-0
lines changed

1 file changed

+28
-0
lines changed

internal/pkg/agent/application/monitoring/v1_monitor.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -424,6 +424,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
424424
"to": "data_stream.dataset_original",
425425
},
426426
},
427+
"when": map[string]any{
428+
"not": map[string]any{
429+
"has_fields": []any{
430+
"data_stream.dataset_original",
431+
},
432+
},
433+
},
427434
},
428435
},
429436
// drop the dataset field so following copy_field can copy to it
@@ -443,13 +450,27 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
443450
"to": "data_stream.dataset",
444451
},
445452
},
453+
"when": map[string]any{
454+
"not": map[string]any{
455+
"has_fields": []any{
456+
"data_stream.dataset",
457+
},
458+
},
459+
},
446460
"fail_on_error": false,
447461
"ignore_missing": true,
448462
},
449463
},
450464
// possible it's a log message from agent itself (doesn't have component.dataset)
451465
map[string]interface{}{
452466
"copy_fields": map[string]interface{}{
467+
"when": map[string]any{
468+
"not": map[string]any{
469+
"has_fields": []any{
470+
"data_stream.dataset",
471+
},
472+
},
473+
},
453474
"fields": []interface{}{
454475
map[string]interface{}{
455476
"from": "data_stream.dataset_original",
@@ -471,6 +492,13 @@ func (b *BeatsMonitor) injectLogsInput(cfg map[string]interface{}, components []
471492
// update event.dataset with the now used data_stream.dataset
472493
map[string]interface{}{
473494
"copy_fields": map[string]interface{}{
495+
"when": map[string]any{
496+
"not": map[string]any{
497+
"has_fields": []any{
498+
"event.dataset",
499+
},
500+
},
501+
},
474502
"fields": []interface{}{
475503
map[string]interface{}{
476504
"from": "data_stream.dataset",

0 commit comments

Comments
 (0)