You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
We have some messages coming with a duplicate field. Once as hostName and once as hostname. The field hostName comes from the message field which is parsed from the given json. When defining a filter removing hostName, then both fields are removed.
To Reproduce
Define a filter removing hostName:
[FILTER]
name record_modifier
match isa.halfrunt.metric.**
record index isa-metric-10
Remove_Key timestamp
Remove_Key hostName
Bug Report
Describe the bug
We have some messages coming with a duplicate field. Once as
hostName
and once ashostname
. The field hostName comes from the message field which is parsed from the given json. When defining a filter removinghostName
, then both fields are removed.To Reproduce
Define a filter removing
hostName
:Expected behavior
Only the field
hostName
is removed from the record.Screenshots
Your Environment
Additional context
As a valid workaround we remove the
hostName
field using an ingest pipeline.The text was updated successfully, but these errors were encountered: