Split logs by docker container label

[andrew4fr]

There are several running docker containers with labels.
All logs records go through common transforms and then I need to split stream based on label.
But I can't find right condition for swimlanes transform

vector.toml

[sources.in]
  type = "docker"
  include_labels = ["com.atuko.log_shipping=junk", "com.atuko.log_shipping=elastic"]

[transforms.json]
  type = "json_parser"
  inputs = ["in"]
  drop_invalid = true

[transforms.remove_tokens]
  type = "lua"
  inputs = ["json"]
  version = "2"

  hooks.process = """
  function (event, emit)
    if event.log.request ~= nil then
      r = event.log.request:gsub('X%-System%-Token:.*', '')
      r = r:gsub('Authorization:.*', '')
      event.log.request = r
    end

    emit(event)
  end
  """

[transforms.split]
  type = "swimlanes"
  inputs = ["remove_tokens"]

  # Lanes
  [transforms.split.lanes.files]
    type = "check_fields"
    "com.atuko.log_shipping.eq" = "junk"

  [transforms.split.lanes.elastic]
    type = "check_fields"
    "com.atuko.log_shipping.eq" = "elastic"

[sinks.http]
  type = "http"
  inputs = ["split.files"]
  uri = "10.1.1.1:80"
  encoding.codec = "ndjson"

[sinks.elastic]
  type = "elasticsearch"
  inputs = ["split.elastic"]
  host = "10.1.1.1:9000"
  index = "vector-%F"

vector.log

Jul 23 07:52:51.315  INFO vector: Vector is starting. version="0.10.0" git_version="v0.9.0-266-g5e5d806" released="Thu, 25 Jun 2020 14:43:00 +0000" arch="x86_64"
Jul 23 07:52:51.346 TRACE source{name=in type=docker}: vector::sources::docker: Found already running container id=2e6e4e80c1566e3c526bab2f2dabb60d2e539b4a165ea94e4ce4c030b0760057 names=["/target-actions"]
Jul 23 07:52:51.348  INFO vector::sources::docker: Started listening logs on docker container id=2e6e4e80c1566e3c526bab2f2dabb60d2e539b4a165ea94e4ce4c030b0760057
Jul 23 07:53:08.330 TRACE vector::sources::docker: Received one event. event=Log(LogEvent { fields: {"container_created_at": Timestamp(2020-07-23T07:49:25.591113769Z), "container_id": Bytes(b"2e6e4e80c1566e3c526bab2f2dabb60d2e539b4a165ea94e4ce4c030b0760057"), "container_name": Bytes(b"target-actions"), "image": Bytes(b"target-actions:debug"), "label": Map({"com": Map({"atuko": Map({"log_shipping": Bytes(b"junk")})}), "logs_enabled": Bytes(b"true")}), "message": Bytes(b"{\"level\":\"info\",\"host\":\"d4\",\"service\":\"target-actions\",\"event_type\":\"debug\",\"response\":\"HTTP/1.1 204 No Content\",\"response_code\":204,\"time\":\"2020-07-23T10:53:08+03:00\",\"message\":\"ok\"}"), "source_type": Bytes(b"docker"), "stream": Bytes(b"stderr"), "timestamp": Timestamp(2020-07-23T07:53:08.325606575Z)} })

[pgassmann]

This is probably also because the label is transformed to a map and is then no longer a single field.
related to #5716 ?

Can't find info on the split transform. should be transform route now. https://vector.dev/docs/reference/configuration/transforms/route/

[JeanMertz]

It appears the solution(s) provided in #5716 has resolved this discussion. If that is not the case, feel free to mark this discussion as unresolved.