How to parse kubernetes logs with Fluentd

John777 0
Viewed 23

I use few services in EKS cluster. I want the logs from 1 of my services to be parsed

kubectl logs "pod_name" --> this are the logs when I check directly in the pod service

2022-09-21 10:44:26,434 [springHikariCP housekeeper ] DEBUG HikariPool - springHikariCP - Fill pool skipped, pool is at sufficient level. 2022-09-21 10:44:36,316 [springHikariCP housekeeper ] DEBUG HikariPool - springHikariCP - Before cleanup stats (total=10, active=0, idle=10, waiting=0)

This service has java based login (Apache Commons logging) and in kibana at the moment is displayed whole log message with date and time + Log Level + message : kibana logs from my service

Is it possible this whole log to be parsed into the separate fields (time and date + Log Level + message) and displayed in the Kibana like that.

This is my fluentd config file for the source and pattern:

<source>
      @type tail
      path /var/log/containers/*background-executor*.log
      pos_file fluentd-docker.pos
      tag kubernetes.*
      read_from_head true
      <parse>
        @type multi_format
        <pattern>
          format json
          time_key time
          time_type string
          time_format "%Y-%m-%dT%H:%M:%S.%NZ"
          keep_time_key false
        </pattern>
        <pattern>
          format regexp
          expression /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}.\d{3})\s+(?<level>[^\s]+)\s+(?<pid>\d+).*?\[\s+(?<thread>.*)\]\s+(?<class>.*)\s+:\s+(?<message>.*)/
          time_format '%Y-%m-%dT%H:%M:%S.%N%:z'
          keep_time_key false
        </pattern>
      </parse>
    </source>
fluentd
1 Answers

You have to just update the filter as per need

<filter **>
@type record_transformer
enable_ruby
<record>
foo "bar"
KEY "VALUE"
podname "${record['tailed_path'].to_s.split('/')[-3]}"
test "passed"
time "${record['message'].match('[0-9]{2}\\/[A-Z][a-z]{2}\\/[0-9]{4}:[0-9]{2}:[0-9]{2}:[0-9]{2}\\s
+[0-9]{4}').to_s}"
</record>
</filter>

you have to parse the record & message with data something like if between [0-9] or [A-Z] same way show in above example.

Edit the filter.conf

You can create your own Key and value, in value you have to parse the filed and flutenD will populate the value.

Harsh Manvar0
Related