In a recent release (5.5 and 5.4.4), de-dotting was removed for fields like:
app.kubernetes.io/component
In previous versions, this was replaced with something like:
app_kubernetes_io/component
The change is in this pull request. I believe it is implemented because of: https://issues.redhat.com/browse/LOG-2774

This causes issues for some ClusterLogForwarding to external Elasticsearch deployments. Customer has an ELK deployment and is getting errors:

failed to parse field [kubernetes.labels.app] of type [text] in document with id '3UzwaIIBfHLB8nIgKjCC'. Preview of field's value: '{kubernetes={io/component=prometheus}}'

In this case, the log flow is:

ClusterLogForwarder > logstash > External Elasticsearch

 
subscription-clo: currentCSV: cluster-logging.5.4.4