Unexpected behaviour with Nest filter

[Frode Høyvik]

Hi, before creating an issue, I would like to check whether what I am seeing is expected behaviour. I am using Fluent Bit 1.0.4, and having multiple Nest filters with the same "Nest_under" key results in multiple top-level fields being created. A single Nest filter with multiple "Wildcard" entries, on the other hand, results in a single top-level field being created.

To be more specific:

while :; do echo "{\"stream\":\"stdout\",\"time\":\"time-value\"}"; sleep 1; done | \

./fluent-bit -f 1 -i stdin -t mytag -F nest -m mytag -p operation=nest -p wildcard=time -p nest_under=docker -F nest -m mytag -p operation=nest -p wildcard=stream -p nest_under=docker -o stdout

gives [0] mytag: [1551367861.024432224, {"docker"=>{"time"=>"time-value"}, "docker"=>{"stream"=>"stdout"}}]

, whereas

while :; do echo "{\"stream\":\"stdout\",\"time\":\"time-value\"}"; sleep 1; done | \

./fluent-bit -f 1 -i stdin -t mytag -F nest -m mytag -p operation=nest -p wildcard=time -p wildcard=stream -p nest_under=docker -o stdout

gives [0] mytag: [1551368111.465392923, {"docker"=>{"stream"=>"stdout", "time"=>"time-value"}}]

I would have expected both of these to give the same result (i.e. the second entry), but as long as there is a way to achieve what I want, I am also fine with the existing behaviour. :)

Regards,

Frode

[Eduardo Silva]

Hi Frode, 

looks like the filter is not validating if the outgoing new entry already exists, if exists I would expect the current map to be expanded but looks like is not the case (or not a case to be covered).

Michiel, is this an expected behavior?

regards, 

--
You received this message because you are subscribed to the Google Groups "Fluent-Bit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluent-bit+...@googlegroups.com.
To post to this group, send email to fluen...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/fluent-bit/01aa21bb-21e4-41b0-bc63-db772fc14878%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Eduardo Silva
Principal Engineer  | Arm
. . . . . . . . . . . . . . . . . . . . . . . . . . . 
m. +506 70138007
Arm.com
Treasuredata.com