Kubernetes Filter

The Kubernetes Filter allows to enrich your log files with Kubernetes metadata.

When Fluent Bit is deployed in Kubernetes as a DaemonSet and configured to read the log files from the containers (using tail plugin), this filter aims to perform the following operations:

  • Analize the Tag and extract the following metadata:
    • POD Name
    • Namespace
    • Container Name
    • Container ID
  • Query Kubernetes API Server to obtain extra metadata for the POD in question:
    • POD ID
    • Labels
    • Annotations

The data is cached locally in memory and appended to each record.

Configuration Parameters

The plugin supports the following configuration parameters:

Key Description Default
Kube_URL API Server end-point https://kubernetes.default.svc:443
Kube_CA_File CA certificate file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
Kube_Token_File Token file /var/run/secrets/kubernetes.io/serviceaccount/token
Merge_JSON_Log Interpret message log field as a structured message Off
Merge_JSON_Key Set a new key name to append log structured message
Dummy_Meta Append dummy metadata Off

Kube_URL

The filter aims to enrigh logs with Kubernetes metadata, this information comes from the Kubernetes API Server and the Kube_URL configuration property aims to specify the HTTP endpoint of the API Server. Different Kubernetes deployments might have a different end-points.

Default https://kubernetes.default.svc:443

Kube_CA_File

When accessing the API Server in secure mode (TLS), the Kube_CA_File defines the absolute path for the root CA certificate. This certificate exists on every node of the cluster.

Default /var/run/secrets/kubernetes.io/serviceaccount/ca.crt

Kube_Token_File

When accessing the API Server, the Kubernetes HTTP end-point requires an authorization token. The Kube_Token_File defines the absolute path of this token.

Default /var/run/secrets/kubernetes.io/serviceaccount/token

Merge_JSON_Log

Applications might generate their logs in JSON format, if so the container engine (e.g: Docker) will threat that log line as a string leading to a nested JSON map. Enabling Merge_JSON_Log instruct Fluent Bit to parse and format that JSON-string as native structured fields.

Default Off

Merge_JSON_Key

Specify an optional key name to append structured fields from the log message when Merge_JSON_Log is enabled.

this option has been introduced in Fluent Bit v0.11.11

Dummy_Meta

When enabled this option makes the filter to skip API Server and instead just insert a dummy metadata into each log line. This option is available only for testing and development purposes, do not use in production.

this option has been introduced in Fluent Bit v0.11.11

results matching ""

    No results matching ""