kiwigrid/helm-charts

[fluentd-elasticsearch] Add systemd field strip underscores and field lowercase to other sources

Closed this issue · 1 comments

nvtkaszpir commented

Is this a request for help?:

No

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
Feature Request.

Currently fluentd in systemd.input.conf in the ver end in @id kernel is using:

      <entry>
        fields_strip_underscores true
        fields_lowercase true
      </entry>

I believe this section should be added to other systemd type inputs.

Pros:

  • lowercase field names in elasticsearch
  • fields not starting with underscore in elasticsearch are indexed

Cons:

  • will break existing dashboards and queries in kubana/grafana/

Version of Helm and Kubernetes:
helm 2.14.3
k8s 1.14.9-gke.2

Which chart in which version:
fluentd-elasticsearch
5.3.1

What happened:
kubana shows entries with field names such as:
_PID
_PRORITY
and other

What you expected to happen:
_PID field should be named as pid
_PRIORITY should be named as priority

How to reproduce it (as minimally and precisely as possible):
use helm chart defaults

Anything else we need to know:

I can provide PRs with fixes