Fluentbit record_modifier 如何用斜杠删除键？

Question

我正在尝试从我使用 fluentbit v.2.0.5 解析的日志中删除不感兴趣的 kube.netes 元数据。

在几个具有提升操作的嵌套过滤器之后，我试图删除键名中带有斜线的键，仍然在 elasticsearch 中看到它

在 elasitcsearch 中登录过滤器和 json 下面。 例如，k8s_pod_id、k8s_docker_id 之类的键被删除了，但是带有'/'的键仍然存在

`

[FILTER]
    Name record_modifier
    Match kube.*
    Remove_key k8s_pod_id
    Remove_key k8s_docker_id
    Remove_key k8s_labels_pod-template-hash
    Remove_key k8s_container_hash
    Remove_key k8s_annotations_checksum/config
    Remove_key k8s_annotations_kubernetes_io/config_source
    Remove_key k8s_annotations_kubernetes_io/psp
    Remove_key k8s_labels_app_kubernetes_io/instance

{
  "_index": "kube-2022.12.10",
  "_id": "p79h_YQBhdSEPVFK5hZr",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2022-12-10T18:52:41.244Z",
    "level": "info",
    "msg": "kubernetes_sd_configs: added targets: 4, removed targets: 4; total targets: 87",
    "time": "2022-12-10T18:52:41.24443571Z",
    "region": "eu-west-1",
    "k8s_pod_name": "victoria-metrics-agent-68b4d79567-4p5jm",
    "k8s_namespace_name": "monitoring",
    "k8s_container_name": "victoria-metrics-agent",
    "k8s_container_image": "victoriametrics/vmagent:v1.81.2",
    "k8s_annotations_checksum/config": "3c9d197fd433243999f2700713e4ab61fc01e056a97ecbfe0f782bbaa931e6a7",
    "k8s_annotations_kubernetes_io/config_seen": "2022-12-07T10:26:57.838470108Z",
    "k8s_annotations_kubernetes_io/config_source": "api",
    "k8s_annotations_kubernetes_io/psp": "eks.privileged",
    "k8s_labels_app_kubernetes_io/instance": "victoria-metrics-agent",
    "k8s_labels_app_kubernetes_io/name": "victoria-metrics-agent"
  },

`

我试图用反斜杠转义“/”，也用 qouts 包装密钥

Answer 1

一种选择是使用以下过滤器删除所有这些注释

 Remove_key annotations