Add source path matching to add_docker_metadata processor
#4495
Conversation
exekias
force-pushed
the
fb-add_docker_metadata
branch
from
353b7a1
to
c8c8f93
Compare
This should be useful to enrich events coming from docker logs, as it will parse the container id from the source path.
exekias
force-pushed
the
fb-add_docker_metadata
branch
from
c8c8f93
to
cf3d393
Compare
| func (f extract_field) Run(event common.MapStr) (common.MapStr, error) { | ||
| fieldValue, err := event.GetValue(f.Field) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("Error getting field '%s' from event", f.Field) |
There was a problem hiding this comment.
Use lower case error strings. https://github.com/golang/go/wiki/CodeReviewComments#error-strings
| } | ||
|
|
||
| parts := strings.Split(value, f.Separator) | ||
| parts = deleteEmpty(parts) |
There was a problem hiding this comment.
Doesn't this create is disconnect between the configured index and the index into parts?
There was a problem hiding this comment.
I don't fully get this question, but will explain why I had to delete empty parts. When you split a string like /var/lib/docker/containers/foo you get [ '', 'var', 'docker', 'containers', 'foo' ]. It's counter intuitive to ask for index 4 and get containers (I would expect foo) because of the empty string at the beginning. Things get worse if you have things like /var//lib/...
There was a problem hiding this comment.
That answers my question (I was thinking of the /var//lib/... case).
|
|
||
| result, err := actual.GetValue(test.Target) | ||
| assert.NoError(t, err) | ||
| assert.Equal(t, result.(string), test.Result) |
There was a problem hiding this comment.
Does this type assertion panic if there was an err? I'm not a fan of assert.NoError due to it continuing on error. Maybe use "if assert.NoError { assert.Equal }". Check other uses and possibly replace with an "if err then t.Fatal".
exekias
force-pushed
the
fb-add_docker_metadata
branch
from
9fd07ef
to
9f5b969
Compare
exekias
force-pushed
the
fb-add_docker_metadata
branch
from
9f5b969
to
0df8b11
Compare
|
jenkins retest this |
This change adds
match_sourcesetting to automatically matchsourcefield from filebeat events. Default settings take care of most common scenario. It will match/var/lib/docker/containers/<container_id>/*.log. Thematch_source_indexsetting allows changing this to match other position in the path. Just use: