elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
83 stars 4.92k forks source link

[Filebeat] CEL / broken mito version #41486

Open pudovd opened 2 days ago

pudovd commented 2 days ago

I use an Agent CR with ECK to get logs from the Loki via CEL integration.

It works well on the agent versions 8.13.4 and 8.14.3 But it fails with version 8.15.3.

I've found out that the reason is the new version of mito.
There is compatible matrix the mito versions and my code (see attachements):

beats version mito version ok?
8.13.0 1.9.0 true
8.14.0 1.10.0 true
8.15.0 1.13.1 false
- 1.14.0 false
- 1.15.0 true

The error is:

$ go install github.com/elastic/mito/cmd/mito@v1.13.1
$ mito -data loki-gitlab-audit.state.json loki-gitlab-audit.cel 
failed program instantiation: failed compilation: ERROR: <input>:77:29: type 'list(map(string, dyn))' does not support field selection
 |                 val.map(v, v.timestamp != state.cursor.inputs.start_ts ? v : {}).drop_empty().as(filtered,
 | ............................^
ERROR: <input>:77:72: found no matching overload for '_?_:_' applied to '(bool, list(map(string, dyn)), map(dyn, dyn))'
 |                 val.map(v, v.timestamp != state.cursor.inputs.start_ts ? v : {}).drop_empty().as(filtered,
 | .......................................................................^

loki-gitlab-audit.cel.txt loki-gitlab-audit.state.json

botelastic[bot] commented 2 days ago

This issue doesn't have a Team:<team> label.