fluent / fluent/fluent-bit

Modify filter not working with Record Accessors

Open
#4,651 21 comments 47 reactions 0 assignees View on GitHub
enhancement feature-request
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

## Bug Report

When using the modify filter to copy nested fields using Record Accessors, the filter fails to find the fields.

**To Reproduce**

- Configuration:
```
[FILTER]
Name modify
Match kube.*
Copy $kubernetes['labels']['app'] application
Copy $kubernetes['labels']['app.kubernetes.io/name'] application
Copy $kubernetes['container_name'] application
Remove $kubernetes['pod_id']
Remove $kubernetes['docker_id']
Remove $kubernetes['container_hash']
```
- Fluent Bit debug log
```
[2022/01/21 14:54:40] [debug] [filter:modify:modify.4] Rule COPY $kubernetes['labels']['app'] TO application : No keys matching $kubernetes['labels']['app'] found, not applying rule
[2022/01/21 14:54:40] [debug] [filter:modify:modify.4] Rule COPY $kubernetes['labels']['app.kubernetes.io/name'] TO application : No keys matching $kubernetes['labels']['app.kubernetes.io/name'] found, not applying rule
[2022/01/21 14:54:40] [debug] [filter:modify:modify.4] Rule COPY $kubernetes['container_name'] TO application : No keys matching $kubernetes['container_name'] found, not applying rule
```
- Output (sent to aws Cloudwatch)
```
{
"log": "[14:55:24 INF] REDACTED",
"stream": "stdout",
"time": "2022-01-21T14:55:24.532788648Z",
"kubernetes": {
"pod_name": "REDACTED",
"namespace_name": "REDACTED",
"pod_id": "723efe40-122a-4b93-960c-f79b09dc583f",
"labels": {
"app": "REDACTED",
"controller-uid": "618de15b-8c23-47a2-8ac8-34cc1d59122d",
"job-name": "REDACTED",
"release": "REDACTED"
},
"annotations": {
"kubernetes.io/psp": "eks.privileged"
},
"host": "REDACTED",
"container_name": "REDACTED",
"docker_id": "59a6665e0e27623e475a49a382e070c63c72b8673e6debcdc63444a455ecb6a9",
"container_hash": "REDACTED",
"container_image": "REDACTED"
}
}
```
- Steps to reproduce the problem:

**Expected behavior**
'application' field should be added to the log structure with the value taken from one of the 3 found fields.
$kubernetes['pod_id'], $kubernetes['docker_id'], $kubernetes['container_hash'] should be removed from the log structure.

**Your Environment**
* Version used: Latest
* Configuration:
```
[FILTER]
Name kubernetes
Match kube.*
Merge_Log On
Keep_Log Off
K8S-Logging.Parser On
K8S-Logging.Exclude On

[FILTER]
Name expect
Match kube.*
key_exists kubernetes
key_exists log
action exit

[FILTER]
Name grep
Match kube.*
Exclude $kubernetes['namespace_name'] kube-system

[FILTER]
Name stdout
Match kube.*

[FILTER]
Name modify
Match kube.*
Copy $kubernetes['labels']['app'] application
Copy $kubernetes['labels']['app.kubernetes.io/name'] application
Copy $kubernetes['container_name'] application
Remove $kubernetes['pod_id']
Remove $kubernetes['docker_id']
Remove $kubernetes['container_hash']

```
* Environment name and version (e.g. Kubernetes? What version?): Kubernetes, Latest
* Operating System and version: AWS Linux
* Filters and plugins: kubernetes, expect, grep, stdout, modify, cloudwatch_logs

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the configuration with Fluent Bit's modify filter and inspect how Record Accessors are handled for nested kubernetes fields. Verify the Copy and Remove rules against the supplied log structure; done means application is populated and the specified pod_id, docker_id, and container_hash fields are removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, kubernetes
Domain
stream-processing, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.