Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-8614

[release-6.3]Missing fields on event: ["file"] when rateLimitPerContainer is enabled.

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Hide
      Before this update, enabling rateLimitPerContainer could cause error events: error=Missing fields on event: ["file"], due to incorrect configuration generation for the throttle section. With this update, the throttle configuration is generated correctly, ensuring all expected event fields are preserved.
      Show
      Before this update, enabling rateLimitPerContainer could cause error events: error=Missing fields on event: ["file"], due to incorrect configuration generation for the throttle section. With this update, the throttle configuration is generated correctly, ensuring all expected event fields are preserved.
    • Bug Fix
    • Logging - Sprint 283
    • Moderate

      Description of problem:

      when tuning.rateLimitPerContainer.maxRecordsPerSecond: n is enabled. Collector report '
      Failed to render template for "key_field". error=Missing fields on event: ["file"]'.

      oc logs pod/collector-nf56n -c collector --tail=25
      Creating the directory used for persisting Vector state /var/lib/vector/openshift-logging/collector
      Starting Vector process...
      2026-01-25T08:41:15.293325Z  WARN vector::config::loading: Transform "output_my_lokistack_route._unmatched" has no consumers
      2026-01-25T08:41:32.167092Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:41:32.167146Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:41:43.006965Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 36 times.
      2026-01-25T08:41:43.006982Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:41:44.040368Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:41:53.849727Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 10 times.
      2026-01-25T08:41:53.849744Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:41:54.882168Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:42:04.172219Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 9 times.
      2026-01-25T08:42:04.172235Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:42:04.691732Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:42:15.012383Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 10 times.
      2026-01-25T08:42:15.012398Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:42:16.044721Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:42:25.852052Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 10 times.
      2026-01-25T08:42:25.852067Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:42:26.883565Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      2026-01-25T08:42:36.175178Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] has been suppressed 9 times.
      2026-01-25T08:42:36.175197Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Failed to render template for "key_field". error=Missing fields on event: ["file"] error_type="template_failed" stage="processing" internal_log_rate_limit=true
      2026-01-25T08:42:37.207646Z  WARN transform{component_kind="transform" component_id=input_myapp_container_throttle component_type=throttle}: vector::internal_events::template: Internal log [Failed to render template for "key_field".] is being suppressed to avoid flooding.
      
      

      How reproducible:

      Always

      Steps to Reproduce:

      1. deploy clf with rateLimitPerContainer
      apiVersion: observability.openshift.io/v1
      kind: ClusterLogForwarder
      metadata:
        name: collector
      spec:
        inputs:
        - application:
            tuning:
              rateLimitPerContainer:
                maxRecordsPerSecond: 10
          name: myapp
          type: application
        managementState: Managed
        outputs:
        - lokiStack:
            authentication:
              token:
                from: serviceAccount
            target:
              name: logging-loki
              namespace: openshift-logging
          name: my-lokistack
          tls:
            ca:
              configMapName: openshift-service-ca.crt
              key: service-ca.crt
          type: lokiStack
        pipelines:
        - inputRefs:
          - myapp
          name: pipe1
          outputRefs:
          - my-lokistack
        serviceAccount:
          name: logcollector
      
      1. check the collector pods logs.
      2. ...

      Actual results:

      Expected results:

      Additional info:

              vparfono Vitalii Parfonov
              rhn-support-anli Anping Li
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: