Searching PCF data using subscription-id field doesn't produce results

[johnansett]

Hey guys, got a kinda weird one. I am have PCF (Pivotal Cloud Foundry) data coming into an index from 3 clusters.

I can see the three cluster's in the subscription-id field when I search the whole index:
index=pcf
However if I try and isolate on a cluster using subscription-id it doesn't work.

index=pcf subscription-id=*

Works

index=pcf subscription-id="cluster-a-1"

Does NOT

index=pcf subscription-id="cluste*"

Works

index=pcf subscription-id="cluster-a*"

Does NOT

It also means the PCF apps don't work.

Any ideas what might be going on here. Not sure if this is specific to the PCF data or other data sources as well but this is the only one I've seen so far.

Thanks!

[VatsalJagani]

@johnansett,

One silly solution as I've doubt about field name. index=pcf | rename "subscription-id" as subid | search subid=*. Try and let me know your feedback.

[guilmxm]

HI @johnansett

I know this post is a bit old, but did you find how to get the subscription-id field ?
Got a customer starting to ingest PCF data, I re-factored the app to fix several issues it has, some searches will work but most don't because of this field not existing.

Guilhem