field name compatibility for SCK

CHANGELOG.md

@@ -4,6 +4,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Added
+
+- Field name compatibility for SCK and index routing precedence (#258)
+
 ## [0.37.1] - 2021-11-01
 
 ### Added

helm-charts/splunk-otel-collector/templates/config/_common.tpl

@@ -101,6 +101,49 @@ resource/logs:
     - key: istio_service_name
       action: delete
     {{- end }}
+    {{- if .Values.splunkPlatform.fieldNameConvention.renameFieldsSck }}
+    - key: container_name
+      from_attribute: k8s.container.name
+      action: upsert
+    - key: cluster_name
+      from_attribute: k8s.cluster.name
+      action: upsert
+    - key: container_id
+      from_attribute: k8s.container.id
+      action: upsert
+    - key: pod
+      from_attribute: k8s.pod.name
+      action: upsert
+    - key: pod_uid
+      from_attribute: k8s.pod.uid
+      action: upsert
+    - key: namespace
+      from_attribute: k8s.namespace.name
+      action: upsert
+    {{- range $_, $label := .Values.extraAttributes.podLabels }}
+    - key: {{ printf "label_%s" $label }}
+      from_attribute: {{ printf "k8s.pod.labels.%s" $label }}
+      action: upsert
+    {{- end }}
+    {{- end }}
+    {{- if not .Values.splunkPlatform.fieldNameConvention.keepOtelContention }}
+    - key: k8s.container.name
+      action: delete
+    - key: k8s.cluster.name
+      action: delete
+    - key: k8s.container.id
+      action: delete
+    - key: k8s.pod.name
+      action: delete
+    - key: k8s.pod.uid
+      action: delete
+    - key: k8s.namespace.name
+      action: delete
+    {{- range $_, $label := .Values.extraAttributes.podLabels }}
+    - key: {{ printf "k8s.pod.labels.%s" $label }}
+      action: delete
+    {{- end }}
+    {{- end }}
 {{- end }}
 
 {{/*

helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl

@@ -436,9 +436,11 @@ service:
         - batch
         {{- if not .Values.otelCollector.enabled }}
         - filter/logs
-        - resource/logs
         {{- end }}
         - resource
+        {{- if not .Values.otelCollector.enabled }}
+        - resource/logs
+        {{- end }}
         - resourcedetection
         {{- if .Values.environment }}
         - resource/add_environment

helm-charts/splunk-otel-collector/values.schema.json

@@ -76,6 +76,18 @@
         "metricsEnabled": {
           "description": "Send Metrics to Splunk Platform",
           "type": "boolean"
+        },
+        "fieldNameConvention": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "renameFieldsSck": {
+              "type": "boolean"
+            },
+            "keepOtelConvention": {
+              "type": "boolean"
+            }
+          }
         }
       },
       "anyOf": [

helm-charts/splunk-otel-collector/values.yaml

@@ -67,6 +67,13 @@ splunkPlatform:
   logsEnabled: true
   metricsEnabled: true
 
+  # Field name conventions to use. (Only for those who are migrating from Splunk Connect for Kubernetes helm chart)
+  fieldNameConvention:
+    # Boolean for renaming pod metadata fields to match to Splunk Connect for Kubernetes helm chart.
+    renameFieldsSck: false
+    # Boolean for keeping Otel convention fields after renaming it
+    keepOtelConvention: true
+
 ################################################################################
 # Splunk Observability configuration
 ################################################################################

rendered/manifests/agent-only/configmap-otel-agent.yaml

@@ -126,6 +126,20 @@ data:
           key: k8s.pod.annotations.splunk.com/sourcetype
         - action: delete
           key: splunk.com/exclude
+        - action: delete
+          key: k8s.container.name
+        - action: delete
+          key: k8s.cluster.name
+        - action: delete
+          key: k8s.container.id
+        - action: delete
+          key: k8s.pod.name
+        - action: delete
+          key: k8s.pod.uid
+        - action: delete
+          key: k8s.namespace.name
+        - action: delete
+          key: k8s.pod.labels.app
       resourcedetection:
         detectors:
         - env
@@ -203,8 +217,8 @@ data:
           - k8sattributes
           - batch
           - filter/logs
-          - resource/logs
           - resource
+          - resource/logs
           - resourcedetection
           receivers:
           - fluentforward

rendered/manifests/agent-only/daemonset.yaml

@@ -28,7 +28,7 @@ spec:
         app: splunk-otel-collector
         release: default
       annotations:
-        checksum/config: 52e8817609546ab6ecf5a8e403605a5eb4f85ac8191d7c251814ac3d512dac0c
+        checksum/config: e57325e2f3e96d36339ae360b93ad73cc27fa5e0d34daa5d18bc09dcfe5fb2ea
         kubectl.kubernetes.io/default-container: otel-collector
     spec:
       hostNetwork: true

rendered/manifests/gateway-only/configmap-otel-collector.yaml

@@ -108,6 +108,20 @@ data:
           key: k8s.pod.annotations.splunk.com/sourcetype
         - action: delete
           key: splunk.com/exclude
+        - action: delete
+          key: k8s.container.name
+        - action: delete
+          key: k8s.cluster.name
+        - action: delete
+          key: k8s.container.id
+        - action: delete
+          key: k8s.pod.name
+        - action: delete
+          key: k8s.pod.uid
+        - action: delete
+          key: k8s.namespace.name
+        - action: delete
+          key: k8s.pod.labels.app
       resourcedetection:
         detectors:
         - env

rendered/manifests/gateway-only/deployment-collector.yaml

@@ -30,7 +30,7 @@ spec:
         component: otel-collector
         release: default
       annotations:
-        checksum/config: 792d830893ffad4b22a959320e4992cc5fb336697b87e5c908a50589c2abb946
+        checksum/config: 767733d344d40e3800193acf2e4e114ce826b2ac1e4140e3f8f70662957335e5
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

rendered/manifests/logs-only/configmap-otel-agent.yaml

@@ -123,6 +123,20 @@ data:
           key: k8s.pod.annotations.splunk.com/sourcetype
         - action: delete
           key: splunk.com/exclude
+        - action: delete
+          key: k8s.container.name
+        - action: delete
+          key: k8s.cluster.name
+        - action: delete
+          key: k8s.container.id
+        - action: delete
+          key: k8s.pod.name
+        - action: delete
+          key: k8s.pod.uid
+        - action: delete
+          key: k8s.namespace.name
+        - action: delete
+          key: k8s.pod.labels.app
       resourcedetection:
         detectors:
         - env
@@ -162,8 +176,8 @@ data:
           - k8sattributes
           - batch
           - filter/logs
-          - resource/logs
           - resource
+          - resource/logs
           - resourcedetection
           receivers:
           - fluentforward

rendered/manifests/logs-only/daemonset.yaml

@@ -28,7 +28,7 @@ spec:
         app: splunk-otel-collector
         release: default
       annotations:
-        checksum/config: b7b0093f43ac7c544c4bc89dd86e8700f21b408e9bf72d99796f6158a1da0ba7
+        checksum/config: 67987a09b34e25f89564b4dc1f55e48a0866e0108fc2107fc38ccdddccc093e4
         kubectl.kubernetes.io/default-container: otel-collector
     spec:
       hostNetwork: true

rendered/manifests/metrics-only/configmap-otel-agent.yaml

@@ -120,6 +120,20 @@ data:
           key: k8s.pod.annotations.splunk.com/sourcetype
         - action: delete
           key: splunk.com/exclude
+        - action: delete
+          key: k8s.container.name
+        - action: delete
+          key: k8s.cluster.name
+        - action: delete
+          key: k8s.container.id
+        - action: delete
+          key: k8s.pod.name
+        - action: delete
+          key: k8s.pod.uid
+        - action: delete
+          key: k8s.namespace.name
+        - action: delete
+          key: k8s.pod.labels.app
       resourcedetection:
         detectors:
         - env

rendered/manifests/metrics-only/daemonset.yaml

@@ -27,7 +27,7 @@ spec:
         app: splunk-otel-collector
         release: default
       annotations:
-        checksum/config: a2ddd09def6ab417ec0967414e446ebf9adfae0e109ac263863cff98c23cdd7e
+        checksum/config: 8547764e97e4aa55b04ddbaaf651078198b7c0d68c01bae3505e2371e8f59cc6
         kubectl.kubernetes.io/default-container: otel-collector
     spec:
       hostNetwork: true

rendered/manifests/traces-only/configmap-otel-agent.yaml

@@ -123,6 +123,20 @@ data:
           key: k8s.pod.annotations.splunk.com/sourcetype
         - action: delete
           key: splunk.com/exclude
+        - action: delete
+          key: k8s.container.name
+        - action: delete
+          key: k8s.cluster.name
+        - action: delete
+          key: k8s.container.id
+        - action: delete
+          key: k8s.pod.name
+        - action: delete
+          key: k8s.pod.uid
+        - action: delete
+          key: k8s.namespace.name
+        - action: delete
+          key: k8s.pod.labels.app
       resourcedetection:
         detectors:
         - env

rendered/manifests/traces-only/daemonset.yaml

@@ -27,7 +27,7 @@ spec:
         app: splunk-otel-collector
         release: default
       annotations:
-        checksum/config: f73b8bcab68386344194b87d6c10ab64684bb653f3b10b821247864a4da49c48
+        checksum/config: 624830d8ba9ff5724674dd0033b722e9dd9f8b878109f119a031743ca73ab6c2
         kubectl.kubernetes.io/default-container: otel-collector
     spec:
       hostNetwork: true