Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2912

De-dotting removed results in errors for external Elasticsearch forwarding

    XMLWordPrintable

Details

    • False
    • None
    • False
    • NEW
    • NEW
    • Log Collection - Sprint 223

    Description

      In a recent release (5.5 and 5.4.4), de-dotting was removed for fields like:
      app.kubernetes.io/component
      In previous versions, this was replaced with something like:
      app_kubernetes_io/component
      The change is in this pull request. I believe it is implemented because of: https://issues.redhat.com/browse/LOG-2774

      This causes issues for some ClusterLogForwarding to external Elasticsearch deployments. Customer has an ELK deployment and is getting errors:

       

      failed to parse field [kubernetes.labels.app] of type [text] in document with id '3UzwaIIBfHLB8nIgKjCC'. Preview of field's value: '{kubernetes={io/component=prometheus}}'

       

      In this case, the log flow is:

      ClusterLogForwarder > logstash > External Elasticsearch

       
      subscription-clo: currentCSV: cluster-logging.5.4.4
       

      Attachments

        Activity

          People

            Unassigned Unassigned
            rhn-support-stwalter Steven Walter
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: