Skip to main content

Kube Tag Prefix

Error

incoming record tag (kube.containers) is shorter than kube_tag_prefix value (kube.var.log.containers.), skip filter

Reproduce

Set Tag to kube.foobar will trigger error.

    [INPUT]
        Name tail
        Path /var/log/containers/*.log
        multiline.parser docker, cri, java-exception, go
        Tag kube.containers
        Mem_Buf_Limit 5MB
        Skip_Long_Lines On

    [FILTER]
        Name kubernetes
        Match kube.containers
        Merge_Log On
        Keep_Log Off
        Labels Off
        Annotations Off
        K8S-Logging.Parser On
        K8S-Logging.Exclude Off

Reason

Tail support Tags expansion, which means that if a tag have a star character (*), it will replace the value with the absolute path of the monitored file, so if you file name and path is:

/var/log/containers/xxx

then the tag will be (slashes are replaced with dots):

kube.var.log.containers.xxx

Next, it will use Kube_Tag_Prefix which default value is kube.var.log.containers to remove tag prefix. Then the tag will be:

xxx

xxx will be use to extract namespace and pod name data by the following regex.

(?<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$

So, if tag is kube.containers without * ...

Reference

No comments to display

Back to top