Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove_key in Record Modifier should be case sensitive #9742

Open
thwint opened this issue Dec 17, 2024 · 0 comments
Open

Remove_key in Record Modifier should be case sensitive #9742

thwint opened this issue Dec 17, 2024 · 0 comments

Comments

@thwint
Copy link

thwint commented Dec 17, 2024

Bug Report

Describe the bug
We have some messages coming with a duplicate field. Once as hostName and once as hostname. The field hostName comes from the message field which is parsed from the given json. When defining a filter removing hostName, then both fields are removed.

To Reproduce
Define a filter removing hostName:

      [FILTER]
          name            record_modifier
          match           isa.halfrunt.metric.**
          record          index isa-metric-10
          Remove_Key      timestamp
          Remove_Key      hostName
  • Example log message if applicable:
{"serviceName"=>"bangbang", "hostName"=>"bangbang-6546f7cdc8-zk8zd", "tags"=>[{"name"=>"domain", "value"=>"java.lang"}, {"name"=>"mbean_type", "value"=>"OperatingSystem"}, {"name"=>"attribute", "value"=>"OpenFileDescriptorCount"}], "values"=>[{"key"=>"value", "intValue"=>156}], "@timestamp"=>1734451912518, "environment"=>"snapshot", "source"=>"backend", "logger"=>"MetricLog", "hostname"=>"bangbang-6546f7cdc8-zk8zd", "service"=>"halfrunt", "index"=>"isa-metric-10"}
  • Steps to reproduce the problem:

Expected behavior
Only the field hostName is removed from the record.

Screenshots

Your Environment

  • Version used: v3.2.1
  • Configuration:
  • Environment name and version (e.g. Kubernetes? What version?):
  • Server type and version:
  • Operating System and version:
  • Filters and plugins: record_modifier, parser, forward, output, lua

Additional context
As a valid workaround we remove the hostName field using an ingest pipeline.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant