Unable to suppress pod metadata with log_namespace: true

[Anton0C]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

I have the following configuration in the Vector agent:

schema:
    log_namespace: true
...
sources:
    source_kubernetes:
      type: kubernetes_logs
      pod_annotation_fields:
        container_id: ""
        container_image_id: ""
        pod_labels: ""
        pod_owner: ""
...
    transform_namespace:
      type: remap
      inputs:
        - source_kubernetes
      source: |
        .event_data = .
        .meta_data = %

However, the pod_annotation_fields are still present, and the suppression doesn’t work as expected according to the documentation: https://vector.dev/docs/reference/configuration/sources/kubernetes_logs/#node_annotation_fields

What is wrong with the configuration, and how can I suppress these fields?

Configuration

No response

Version

0.38.0-debian

Debug Output

No response

Example Data

No response

Additional Context

No response

References

No response

[jszwedko]

Does the pod metadata appear in the metadata (%) or the event (.)?

As a work around, you could delete these fields using a remap transform.

[Anton0C]

Unsuppressed Pod metadata is still present in%kubernetes_logs. To avoid remap and additional resource consumption, it is better for it to work as described in the documentation.

[jszwedko]

Unsuppressed Pod metadata is still present in%kubernetes_logs. To avoid remap and additional resource consumption, it is better for it to work as described in the documentation.

Thanks for confirming! I agree it is a bug that should be fixed, just that remap could be a workaround for now.