Metricbeat mappings

[evilezh]

So few observations.
I've 7.6.0 and running kubernetes modules for metricbeat.
kubernetes.service.ingress_hostname -> this is defined as ip, but as field says - it is hostname not ip, therefore does not match mappipng.
kubernetes.service.cluster_ip -> this can be also "None" which is not exactly ip address, probably field in such case can be dropped out by pipeline code.

[ycombinator]

Hi @evilezh, thanks for the issue. Could you clarify what changes you are looking for here? It sounds like we need to update documentation for these fields but I want to double check with you: is that what you're looking for or something else? Thanks!

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[evilezh]

Sorry for late reponse. I'm just letting to know, that some mappings are not exactly correct or fields improperly processed.
ingress_hostname is not ip field
cluster_ip needs processing in pipeline because in certain conditions the value of fields could be "None", therefore needs dropping. Or as alternative, change it to keyword field and users can later process field and extract ip.

[jonatan-ivanov]

This is causing the following exception (this is an AWS EKS example).

{
  "type":"mapper_parsing_exception",
  "reason":"failed to parse field [kubernetes.service.ingress_hostname] of type [ip] in document with id 'abc123'. Preview of field's value: 'xyz123.elb.us-west-2.amazonaws.com'",
  "caused_by":{
    "type":"illegal_argument_exception",
    "reason":"'xyz123.elb.us-west-2.amazonaws.com' is not an IP string literal."
  }
}