-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
Incidents & Support
-
False
-
-
False
-
NEW
-
NEW
-
Bug Fix
-
-
-
Logging - Sprint 278
-
Moderate
Description of problem:
Fields kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not getting pruned for loki output even after applying prun filter
Version-Release number of selected component (if applicable):
Logging 6.3
How reproducible:
Always
Steps to Reproduce:
1> Install Logging with loki stack
2> Try Filter [A]or [B].
[A]
- name: remove-pod-owner2 prune: notIn: - .log_type - .message - .log_source
[B]
- name: prune-filter prune: in: - .kubernetes.container_name - .kubernetes.container.name - .kubernetes_container_name - .kubernetes_container.name - .kubernetes_namespace_name - .kubernetes.namespace_name - .kubernetes.namespace.name - .kubernetes_namespace.name - .kubernetes.pod_name - .kubernetes.pod.name - .kubernetes_pod_name - .kubernetes_pod.name
Actual results:
kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not pruned
Expected results:
Fileds kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name should be pruned or they should be listed as non-prunable fileds in doc
Additional info:
For audit logs where no values are there for
kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name they are blank still there and not prunable
NOTE Please see attched images to get clarity on issue