Skip to content

Testing if field exists in omit_if doesn't work #2188

@ViliusS

Description

@ViliusS

Describe the bug
According to https://docs.cloud.google.com/logging/docs/view/logging-query-language#missing_fields testing for missing logging fields should work using :*. Unfortunately, this doesn't work in omit_if. move_fields processor accepts field:* as a filter, but doesn't work in the end.

To Reproduce
Steps to reproduce the behavior:

  1. Start a GCE VM with image 'rocky-linux-9-v20260115'
  2. Install Ops Agent version 'google-cloud-ops-agent-2.63.0-1.el9.x86_64.rpm'
  3. Customize the agent with the following configuration and restart the agent
logging:
  receivers:
    test_log:
      type: tcp
      format: json
  processors:
    add_context_on_exception:
      type: modify_fields
      fields:
        jsonPayload.service:
          static_value: 'my-service'
          omit_if: -jsonPayload.exception:*
  service:
    pipelines:
      default_pipeline:
        processors: [add_context_on_exception]
        receivers: [test_log]

Expected behavior
This should add jsonPayload.service field populated with my-service value only when jsonPayload.exception field exists, but it doesn't.

Environment (please complete the following information):

  • VM distro / OS: Rocky Linux 9.7
  • Ops Agent version 2.63.0

Additional context
The workaround I found is to use any character in the filter which I would expect in the exception field to be found, for example letter 'a'. Of course this is just workaround and doesn't work in all case, for example when letter 'a' is missing from the exception.

logging:
  receivers:
    test_log:
      type: tcp
      format: json
  processors:
    add_context_on_exception:
      type: modify_fields
      fields:
        jsonPayload.service:
          static_value: 'my-service'
          omit_if: -jsonPayload.exception:"a"
  service:
    pipelines:
      default_pipeline:
        processors: [add_context_on_exception]
        receivers: [test_log]

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions