From cf1c78c85dda1fd0c3d2e072efd52b903da2cdb0 Mon Sep 17 00:00:00 2001 From: chrismark Date: Thu, 16 Dec 2021 13:07:15 +0000 Subject: [PATCH] Enhance filter check in k8s event metricset Signed-off-by: chrismark --- libbeat/common/kubernetes/types.go | 5 +++++ metricbeat/module/kubernetes/event/event.go | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/libbeat/common/kubernetes/types.go b/libbeat/common/kubernetes/types.go index 9f50e99b305..c3d1fefb01e 100644 --- a/libbeat/common/kubernetes/types.go +++ b/libbeat/common/kubernetes/types.go @@ -94,6 +94,11 @@ func Time(t *metav1.Time) time.Time { return t.Time } +// MicroTime extracts time from k8s.MicroTime type +func MicroTime(t *metav1.MicroTime) time.Time { + return t.Time +} + // ContainerID parses the container ID to get the actual ID string func ContainerID(s PodContainerStatus) string { cID, _ := ContainerIDWithRuntime(s) diff --git a/metricbeat/module/kubernetes/event/event.go b/metricbeat/module/kubernetes/event/event.go index 723e1331e61..02755909af4 100644 --- a/metricbeat/module/kubernetes/event/event.go +++ b/metricbeat/module/kubernetes/event/event.go @@ -108,8 +108,16 @@ func (m *MetricSet) Run(reporter mb.PushReporter) { m.watcher.AddEventHandler(kubernetes.FilteringResourceEventHandler{ FilterFunc: func(obj interface{}) bool { eve := obj.(*kubernetes.Event) + // if fields are null they are decoded to `0001-01-01 00:00:00 +0000 UTC` + // so we need to check if they are valid first + lastTimestampValid := kubernetes.Time(&eve.LastTimestamp).Year() > 1 + eventTimeValid := kubernetes.MicroTime(&eve.EventTime).Year() > 1 // if skipOlder, skip events happened before watch - if m.skipOlder && kubernetes.Time(&eve.LastTimestamp).Before(now) { + if m.skipOlder && kubernetes.Time(&eve.LastTimestamp).Before(now) && lastTimestampValid { + return false + } else if m.skipOlder && kubernetes.MicroTime(&eve.EventTime).Before(now) && eventTimeValid { + // there might be cases that `LastTimestamp` is not a valid number so double check + // with `EventTime` return false } return true