fluent / fluent/fluent-bit

Kubernetes events INPUT plugin generates field containing only a dot "."

Open
#11,595 3 comments 2 reactions 0 assignees View on GitHub
status: waiting-for-triage
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 16h
Merged PRs (30d)
58

Description

## Bug Report

**Describe the bug**
When using Kubernetes events input plugin and Opensearch as output plugin, sometimes there are records created with a field with just a dot in the name. This later causes Opensearch to refuse the record with message: `{"type":"illegal_argument_exception","reason":"field name cannot contain only the character [.]"}`

**To Reproduce**
- Example of STDOUT output of the concerning record (redacted for simplicity and to hide sensitive information). The concerning field is `"metadata"=>"managedFields"[0]=>"fieldsV1"=>"f:metadata"=>"f:annotations"=>"."=>{}`
```
{"metadata"=>{"name"=>"name", "namespace"=>"ns", "uid"=>"uid", "resourceVersion"=>"00000", "creationTimestamp"=>"2026-03-20T14:30:20Z", "annotations"=>{"workflows.argoproj.io/node-id"=>"id", "workflows.argoproj.io/node-name"=>"name", "workflows.argoproj.io/node-start-time"=>"00", "workflows.argoproj.io/node-type"=>"StepGroup"}, "managedFields"=>[{"manager"=>"workflow-controller", "operation"=>"Update", "apiVersion"=>"v1", "time"=>"2026-03-20T14:30:20Z", "fieldsType"=>"FieldsV1", "fieldsV1"=>{"f:count"=>{}, "f:firstTimestamp"=>{}, "f:involvedObject"=>{}, "f:lastTimestamp"=>{}, "f:message"=>{}, "f:metadata"=>{"f:annotations"=>{"."=>{}, "f:workflows.argoproj.io/node-id"=>{}, "f:workflows.argoproj.io/node-name"=>{}, "f:workflows.argoproj.io/node-start-time"=>{}, "f:workflows.argoproj.io/node-type"=>{}}}, "f:reason"=>{}, "f:reportingComponent"=>{}, "f:source"=>{"f:component"=>{}}, "f:type"=>{}}}]}, "involvedObject"=>{"kind"=>"Workflow", "namespace"=>"ns", "name"=>"name", "uid"=>"uid", "apiVersion"=>"argoproj.io/v1alpha1", "resourceVersion"=>"00"}, "reason"=>"WorkflowNodeSucceeded", "message"=>"msg", "source"=>{"component"=>"workflow-controller"}, "firstTimestamp"=>"2026-03-20T14:30:20Z", "lastTimestamp"=>"2026-03-20T14:30:20Z", "count"=>1, "type"=>"Normal", "eventTime"=>nil, "reportingComponent"=>"workflow-controller", "reportingInstance"=>"" }
```

**Expected behavior**
I would expected to fields not contain only a dot as a name

**Your Environment**

* Version used: 4.2.2 and 4.2.3
* Configuration: Simple kubernetes_events input plugin and opensearch plugin for output
* Environment name and version (e.g. Kubernetes? What version?): Kubernetes v1.34
* Filters and plugins: INPUT - kubernetes_events

**Additional context**
This appears to only happens to argo workflow pods.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.