fields @timestamp, resource.k8s.pod.name as pod_label |
filter attributes.log.iostream = "stderr" and resource.k8s.namespace.name = "$namespace" |
stats count(pod_label) by resource.k8s.pod.name, bin(30m) |
limit 100
This is my query, and in the table it shows this:
Which is great, however when moving over to the time series, it completely removes the name of the k8 pod but only when there is one pod.
When there are pods with different names it shows all of them, but not when there is just one name.
How do I stop this? I’ve been working on this for a week now.