Q&A

[vstariradev]

Question

I have an otel object that will go to an otel collector.

Depending on the log line processed by vector, some attributes could have value "" sometimes. I'd like to exclude these from being sent to otel.

.resourceLogs = [{
  "resource": {
    "attributes": [
      { "key": "service.name", "value": { "stringValue": "incapsula" } },
    ]
  },
  "scopeLogs": [{
    "scope": {
      "name": "vector-incapsula-parser"
    },
    "logRecords": [{
      "timeUnixNano": to_unix_timestamp!(.timestamp, unit: "nanoseconds"),
      "severityText": "error",
      "severityNumber": 17,
      "body": { "stringValue": "Incapsula WAF Event" },
      "attributes": [
        { "key": "cid", "value": { "stringValue": string(.cid)} },
        { "key": "client.ip", "value": { "stringValue": string(.client.ip)} },
        { "key": "client.geo.country", "value": { "stringValue": string(.client.geo.country_iso_code) } },
        { "key": "user_agent.original", "value": { "stringValue": string(.user_agent.original) } },
        { "key": "http.request.method", "value": { "stringValue": string(.http.request.method) } },
        { "key": "http.response.status_code", "value": { "stringValue": string(.http.response.status_code) } },
        { "key": "event_duration_ms", "value": { "stringValue": string(.event.duration_ms) } },
        { "key": "incapsula.session_id", "value": { "stringValue": string(.incapsula.session_id) } },
        { "key": "incapsula.attack_type", "value": { "stringValue": string(.incapsula.attack_type) } },
        { "key": "incapsula.threat_rule_name", "value": { "stringValue": string(.incapsula.threat_rule_name) } },
        { "key": "incapsula.action", "value": { "stringValue": string(.event.action) } },
        { "key": "incapsula.bot_result", "value": { "stringValue": string(.incapsula.client_application) } }
      ]
    }]
  }]
}]

In the above example cid could be empty sometimes. At these times having the "cid" : "" pair is useless to me and I want to remove it from attributes.

Vector Config

No response

Vector Logs

No response

[vstariradev]

Duplicate of #24299