Allow mapping custom field values via custom annotations

What would you like to be added: I’d like to add the ability to map custom annotations to custom field names, allowing you to set custom fields using custom annotations values.

An example values file for logging might look like this:

customMetadataAnnotations:
  - name: "application"
    annotation: "splunk.com/application-field"

And then, by specifying an annotation splunk.com/application-field on a pod or namespace would map the given value to a custom field application in Splunk for log events originating from that pod or namespace.

Why is this needed: It’s currently not possible to easily customize custom fields with values that may vary from pod to pod, it’s only possible to specify static values. I have tried specifying a static value that included ${record.dig(...)} type expressions, but, because in the config map, the value is wrapped in "", it’s error-prone and doesn’t quite behave as expected.

[matthewmodestino]

@chaitanyaphalak https://github.com/splunk/splunk-connect-for-kubernetes/issues/398

[github-actions[bot]]

This issue was closed because it has been inactive for 14 days since being marked as stale.