Enhance filter check in k8s event metricset

Signed-off-by: chrismark <chrismarkou92@gmail.com>
elastic · Dec 16, 2021 · cf1c78c · cf1c78c
1 parent 533eefb
commit cf1c78c
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/libbeat/common/kubernetes/types.go b/libbeat/common/kubernetes/types.go
@@ -94,6 +94,11 @@ func Time(t *metav1.Time) time.Time {
 	return t.Time
 }
 
+// MicroTime extracts time from k8s.MicroTime type
+func MicroTime(t *metav1.MicroTime) time.Time {
+	return t.Time
+}
+
 // ContainerID parses the container ID to get the actual ID string
 func ContainerID(s PodContainerStatus) string {
 	cID, _ := ContainerIDWithRuntime(s)

diff --git a/metricbeat/module/kubernetes/event/event.go b/metricbeat/module/kubernetes/event/event.go
@@ -108,8 +108,16 @@ func (m *MetricSet) Run(reporter mb.PushReporter) {
 	m.watcher.AddEventHandler(kubernetes.FilteringResourceEventHandler{
 		FilterFunc: func(obj interface{}) bool {
 			eve := obj.(*kubernetes.Event)
+			// if fields are null they are decoded to `0001-01-01 00:00:00 +0000 UTC`
+			// so we need to check if they are valid first
+			lastTimestampValid := kubernetes.Time(&eve.LastTimestamp).Year() > 1
+			eventTimeValid := kubernetes.MicroTime(&eve.EventTime).Year() > 1
 			// if skipOlder, skip events happened before watch
-			if m.skipOlder && kubernetes.Time(&eve.LastTimestamp).Before(now) {
+			if m.skipOlder && kubernetes.Time(&eve.LastTimestamp).Before(now) && lastTimestampValid {
+				return false
+			} else if m.skipOlder && kubernetes.MicroTime(&eve.EventTime).Before(now) && eventTimeValid {
+				// there might be cases that `LastTimestamp` is not a valid number so double check
+				// with `EventTime`
 				return false
 			}
 			return true