Fluent Bit Kubernetes Filter

From wikieduonline
Jump to navigation Jump to search

Kubernetes Filter depends on either tail or Systemd input plugins to process and enrich records with Kubernetes metadata


    Name    tail
    Tag     kube.*
    Path    /var/log/containers/*.log
    Parser  docker

    Name             kubernetes
    Match            kube.*
    Kube_URL         https://kubernetes.default.svc:443
    Kube_CA_File     /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    Kube_Token_File  /var/run/secrets/kubernetes.io/serviceaccount/token
    Kube_Tag_Prefix  kube.var.log.containers.
    Merge_Log        On
    Merge_Log_Key    log_processed


 ## https://docs.fluentbit.io/manual/pipeline/filters
 filters: |
       Name kubernetes
       Match kube.*
       Merge_Log On             # When enabled, it checks if the log field content is a JSON string map, if so, it append the map fields as part of the log structure.
       Keep_Log Off             # When Keep_Log is disabled, the log field is removed from the incoming message once it has been successfully merged (Merge_Log must be enabled as well).
       K8S-Logging.Parser On    # Allow Kubernetes Pods to suggest a pre-defined Parser 
       K8S-Logging.Exclude On   # Allow Kubernetes Pods to exclude logs

Other INPUT examples[edit]

  • [INPUT]
       Name tail
       Path /var/log/containers/*.log
       multiline.parser docker, cri
       Tag kube.*
       Mem_Buf_Limit 5MB
       Skip_Long_Lines On


  • [warn] [filter] NO match rule for kubernetes.0 filter instance, unloading

See also[edit]