-
Bug
-
Resolution: Unresolved
-
Normal
-
Logging 6.3.z
-
Incidents & Support
-
False
-
-
False
-
NEW
-
NEW
-
Before this fix, the prune filter was failing to remove the .kubernetes.container_iostream field. With this fix, the field is now correctly pruned from the log record as expected.
-
Bug Fix
-
-
-
Logging - Sprint 277, Logging - Sprint 278
-
Moderate
Description of problem:
The `.kubernetes.container_iostream` is not getting pruned in Logging 6.3 for Splunk output
Version-Release number of selected component (if applicable):
In Logging 6.2 the field is pruned but in 6.3 its not pruned
How reproducible:
1> Create CLF as Below for 6.3
spec:
filters:
- name: remove-pod-owner
prune:
in:
- .kubernetes.pod_owner
- .kubernetes.annotations
- .kubernetes.container_image
- .kubernetes.container_image_id
- .kubernetes.container_iostream
- .kubernetes.container_id
- .kubernetes.namespace_id
- .kubernetes.namespace_labels
- .openshift
- .openshift.sequence
type: prune
managementState: Managed
outputs:
- name: splunk-forward-app
splunk:
authentication:
token:
key: hecToken
secretName: to-splunk-secret
index: ocp4_{.kubernetes.namespace_name||"none"}
url: http://splunk-default-service.splunk-aosqe.svc:8088
type: splunk
pipelines:
- filterRefs:
- remove-pod-owner
inputRefs:
- application
name: logs-app
outputRefs:
- splunk-forward-app
2> But .kubernetes.container_iostream is not getting pruned
- clones
-
-
- Closed
-
- links to