Kubernetes events INPUT plugin generates field containing only a dot "."
- Dominant language
- C
- Stars
- 8.1k
- Forks
- 2k
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 58
Description
## Bug Report
**Describe the bug**
When using Kubernetes events input plugin and Opensearch as output plugin, sometimes there are records created with a field with just a dot in the name. This later causes Opensearch to refuse the record with message: `{"type":"illegal_argument_exception","reason":"field name cannot contain only the character [.]"}`
**To Reproduce**
- Example of STDOUT output of the concerning record (redacted for simplicity and to hide sensitive information). The concerning field is `"metadata"=>"managedFields"[0]=>"fieldsV1"=>"f:metadata"=>"f:annotations"=>"."=>{}`
```
{"metadata"=>{"name"=>"name", "namespace"=>"ns", "uid"=>"uid", "resourceVersion"=>"00000", "creationTimestamp"=>"2026-03-20T14:30:20Z", "annotations"=>{"workflows.argoproj.io/node-id"=>"id", "workflows.argoproj.io/node-name"=>"name", "workflows.argoproj.io/node-start-time"=>"00", "workflows.argoproj.io/node-type"=>"StepGroup"}, "managedFields"=>[{"manager"=>"workflow-controller", "operation"=>"Update", "apiVersion"=>"v1", "time"=>"2026-03-20T14:30:20Z", "fieldsType"=>"FieldsV1", "fieldsV1"=>{"f:count"=>{}, "f:firstTimestamp"=>{}, "f:involvedObject"=>{}, "f:lastTimestamp"=>{}, "f:message"=>{}, "f:metadata"=>{"f:annotations"=>{"."=>{}, "f:workflows.argoproj.io/node-id"=>{}, "f:workflows.argoproj.io/node-name"=>{}, "f:workflows.argoproj.io/node-start-time"=>{}, "f:workflows.argoproj.io/node-type"=>{}}}, "f:reason"=>{}, "f:reportingComponent"=>{}, "f:source"=>{"f:component"=>{}}, "f:type"=>{}}}]}, "involvedObject"=>{"kind"=>"Workflow", "namespace"=>"ns", "name"=>"name", "uid"=>"uid", "apiVersion"=>"argoproj.io/v1alpha1", "resourceVersion"=>"00"}, "reason"=>"WorkflowNodeSucceeded", "message"=>"msg", "source"=>{"component"=>"workflow-controller"}, "firstTimestamp"=>"2026-03-20T14:30:20Z", "lastTimestamp"=>"2026-03-20T14:30:20Z", "count"=>1, "type"=>"Normal", "eventTime"=>nil, "reportingComponent"=>"workflow-controller", "reportingInstance"=>"" }
```
**Expected behavior**
I would expected to fields not contain only a dot as a name
**Your Environment**
* Version used: 4.2.2 and 4.2.3
* Configuration: Simple kubernetes_events input plugin and opensearch plugin for output
* Environment name and version (e.g. Kubernetes? What version?): Kubernetes v1.34
* Filters and plugins: INPUT - kubernetes_events
**Additional context**
This appears to only happens to argo workflow pods.
Contributor guide
Assessment
This issue has not been assessed yet.