_RESERVED_service help needed

[bsteve99]

Regarding logs going to datadog. How do I get rid of a previously defined service and add my own .service field without it being called _RESERVED_service. when I look at the raw datastructure coming into datadog I see a tags: [ ] section that has a service in it, then I'm trying to add a field called .service. When I add my field called .service it is renamed to _RESERVED_service, because one already exists??? I guess...

Any help appreciated.

[bfung]

Yeah, looks like your guess is correct: https://github.com/vectordotdev/vector/blob/master/src/sinks/datadog/logs/sink.rs#L141

The code comment there suggests that there's also a .service field on the root level of the event that's not inside a tags: [] section.

If you have the raw datastructure, you can put it into the VRL Playground and try out different things into the right format, for example.

[bfung]

From email:

interesting enough... I didn't have any other service tags. I tried a compact(.,true) and it worked! I don't know why, I don't understand whats happening.

So looks like compact(.,true) worked to remove extraneous fields.