-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Change add_cloud_metadata to not overwrite cloud field #11612
Change add_cloud_metadata to not overwrite cloud field #11612
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1 on this change. See comments inside.
"cloud.provider": "ec2", | ||
}, | ||
common.MapStr{ | ||
"cloud.provider": "ec2", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Really expected? Not even sure what ES will do with such a document.
// cloud fields. For example aws module writes cloud.instance.* to events already, with overwrite=false, | ||
// add_cloud_metadata should not overwrite these fields with new values. | ||
if !p.initData.overwrite { | ||
for key := range event.Fields { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do we need to do this? Are we expecting to be dealing with keys containing dots?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@andrewkroh Yeah this is to deal with https://github.com/elastic/beats/pull/11612/files/38badaa57f14922562520ee38de7b9b5aba0aacf#diff-46124ff4b7e0a195eaff6cbeb8a90293R117 if keys containing dot 🤔 For example "cloud.provider": "ec2"
instead of "cloud": common.MapStr{"provider": "ec2"}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wonder if event.Fields.HasKey
would already to the right thing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ruflin event.Fields.HasKey
only check if cloud
field exists but it doesn't check if cloud
field value is null or not. I'm thinking to still use event.GetValue
and compare value with nil
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@kaiyan-sheng Sorry, forgot to publish my recent review comments.
For your question about dotted key check: I general I would say yes but as it's an issue not only affecting cloud, I suggest we keep it as is in this PR and open a follow up issue.
For the tests which from my perspective test the "wrong behaviour" let's keep them but add a comment that this is what happens currently but should be changed. So in case we fix it later we don't stumble over this test and are like: Oh, that is the way it should work.
// cloud fields. For example aws module writes cloud.instance.* to events already, with overwrite=false, | ||
// add_cloud_metadata should not overwrite these fields with new values. | ||
if !p.initData.overwrite { | ||
for key := range event.Fields { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wonder if event.Fields.HasKey
would already to the right thing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. I left some minor documentation edits, but nothing that I need to review again.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One minor doc adjustment. Overall LGTM.
Could you rebase on master to get the build back to green?
I think we should also backport this to 7.0 as I would consider this a bug.
When aws module is enabled, ec2 metricset will collect data with cloud.* included. If metricbeat is running on GCP or other cloud platforms, with the current add_cloud_metadata processor will overwrite the cloud.* fields from ec2 metricset.
This PR is to disable the overwrite part for add_cloud_metadata. When cloud.* exists already, add_cloud_metadata will not overwrite cloud fields.
closes #11305