I think the right way to do this is using the modify filter with conditional rules to overwrite the couchbase.node key:
[FILTER]
|
Name modify
|
Match couchbase.log.*
|
Condition Key_Exists pod['namespace']
|
Condition Key_Exists couchbase['cluster']
|
Condition Key_Exists couchbase['node']
|
Set couchbase.node $couchbase['node'].$couchbase['cluster'].$pod['namespace']
|
Not sure if you can set a nested field that way so confirm, it might also be better to set up a new field for it but really we want a simple one-size-fits-all for Loki labelling with both on-premise and CAO clusters.
I think the right way to do this is using the modify filter with conditional rules to overwrite the couchbase.node key:
[FILTER]
Name modify
Match couchbase.log.*
Condition Key_Exists pod['namespace']
Condition Key_Exists couchbase['cluster']
Condition Key_Exists couchbase['node']
Set couchbase.node $couchbase['node'].$couchbase['cluster'].$pod['namespace']
Not sure if you can set a nested field that way so confirm, it might also be better to set up a new field for it but really we want a simple one-size-fits-all for Loki labelling with both on-premise and CAO clusters.