Vector collector pods crash when kubernetes.label in structuredTypeKey contains "-"

Solution Verified - Updated -

Issue

  • After configuring kubernetes.label in structuredTypeKey in ClusterLogForwarder, collector pods started to crash:

    $ oc get pods -n openshift-logging -l component=collector
    NAME              READY   STATUS             RESTARTS     AGE
    collector-2pwwq   0/1     CrashLoopBackOff   1 (6s ago)   8s
    collector-86xjq   0/1     CrashLoopBackOff   1 (6s ago)   8s
    collector-9nx48   0/1     CrashLoopBackOff   1 (6s ago)   8s
    collector-f62zl   0/1     CrashLoopBackOff   1 (6s ago)   8s
    collector-mrw9h   0/1     CrashLoopBackOff   1 (6s ago)   8s
    collector-vfxrw   0/1     CrashLoopBackOff   1 (6s ago)   8s
    
  • Collector pods are streaming below logs:

    $ oc logs -c collector collector-vfxrw -n openshift-logging
    Creating the directory used for persisting Vector state /var/lib/vector
    Starting Vector process...
    2024-05-10T16:52:39.358368Z  WARN vector::config::loading: Transform "route_container_logs._unmatched" has no consumers
    2024-05-10T16:52:39.489625Z ERROR vector::topology: Configuration error. error=Transform "default_add_es_index": 
    error[E701]: call to undefined variable
      ┌─ :17:34
      │
    17│     val = .kubernetes.labels.region-name
      │                                  ^^^^^^
      │                                  │
      │                                  undefined variable
      │                                  did you mean "true"?
      │
      = see language documentation at https://vrl.dev
      = try your code in the VRL REPL, learn more at https://vrl.dev/examples
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 5
  • Vector

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content