[9.0](backport #6730) Add conditions to copy_fields processor #7331
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This commit adds conditions to the
copy_fields
processor from the monitoring Filebeat to prevent it from failing and spamming the event logger at debug level with:target field xxx already exists, drop or rename this field first
Why is it important?
It makes the debug logs more useful by remove unnecessary entries from our monitoring Filebeat
Checklist
I have made corresponding changes to the documentationI have made corresponding change to the default configuration files./changelog/fragments
using the changelog tool## Disruptive User ImpactHow to test this PR locally
Create a log file with more than 1kb:
docker run -it --rm mingrammer/flog -n 20 > /tmp/flog.log
Package the Elastic-Agent from this PR
Start the Elastic-Agent with the following configuration
elastic-agent.yml
Ensure the event logs (
data/elastic-agent*/logs/events/*.ndjson
) do not contain any messages from thecopy_fields
processor. The following command must return0
:Related issues
copy_fields
processor error #5299Questions to ask yourself
This is an automatic backport of pull request #6730 done by [Mergify](https://mergify.com).