Register kubernetes field_format matcher and remove logger in Encode API #4888
Conversation
|
Can one of the admins verify this patch? |
vjsamuel
force-pushed
the
fix_kubernetes_processor
branch
from
93f753b
to
6ed8fdd
Compare
| logp.Err("Fail to format event (%v): %#v", err, event) | ||
| } | ||
| return serializedEvent, err | ||
| return e.Format.RunBytes(event) |
There was a problem hiding this comment.
@urso, any opinion on this?
There was a problem hiding this comment.
The formatter first tries to extract the fields used in the format string from the event. And only then it applies the event to the format string. One can use default values in the format string.
On error the event will be dropped (even for filebeat). That is, we have to trade excessive logging vs. 'silently' dropping events. The error can be investigated easily. Just dropping without error might confuse users potentially thinking filebeat is super unstable, just cause the configuration is not matching the event.
I checked the outputs and all but redis do log the error as err/warning/critical (depends on output and sending guarantees). I'm ok with removing the log.Err here, but then the error must be logged in the redis output. At some point we need to collect and log potentially excessive logs in a more 'sane' manner.
There was a problem hiding this comment.
@urso, i have logged it as per your request.
|
jenkins test it |
vjsamuel
force-pushed
the
fix_kubernetes_processor
branch
from
6ed8fdd
to
2a2a5fc
Compare
exekias
added
bug
libbeat
needs_backport
exekias
removed
the
needs_backport
…API (elastic#4888) (cherry picked from commit 38aae1e)
…API (elastic#4888) (cherry picked from commit 8d188a5)
field_formatmatcher was not registered. Fixing that.There was a
continuemissing when an unknown matcherFunc was invoked, causing to get nil pointer exception.Removing logger from the Encode API as the error is returned to the caller, lets leave it to the caller to decide if its an error or a graceful failure.