Systemd

https://docs.fluentbit.io/manual/pipeline/inputs/systemd

Configuration

Fluent Bit

    [INPUT]
        Name systemd
        Tag systemd.kubelet
        Systemd_Filter _SYSTEMD_UNIT=kubelet.service
        Read_From_Tail On

    [INPUT]
        Name systemd
        Tag systemd.docker
        Systemd_Filter _SYSTEMD_UNIT=docker.service
        Read_From_Tail On

    [INPUT]
        Name systemd
        Tag systemd.containerd
        Systemd_Filter _SYSTEMD_UNIT=containerd.service
        Read_From_Tail On

OTEL Collector

      transform/systemd:
        error_mode: ignore
        log_statements:
  - context: log
          conditions:
    - IsMap(body)
          statements:
      - set(resource.attributes["service.name"], body["SYSLOG_IDENTIFIER"])
        - set(instrumentation_scope.name, body["_HOSTNAME"])
          - set(attributes["timestamp"], body["timestamp"])
          - set(severity_text, body["PRIORITY"])
          - set(attributes["machine_id"], body["_MACHINE_ID"])
          - set(attributes["hostname"], body["_HOSTNAME"])
          - set(attributes["pid"], body["_PID"])
          - set(attributes["cmd"], body["_CMDLINE"])
          - set(attributes["cgroup"], body["_SYSTEMD_CGROUP"])
          - set(body, body["MESSAGE"])

Log Example

[
  {
    "timestamp": "2025-02-14T07:03:24.189912Z",
    "PRIORITY": "6",
    "_UID": "0",
    "_GID": "0",
    "_CAP_EFFECTIVE": "3fffffffff",
    "_BOOT_ID": "e3c57e797d354858acbab8d8892785ca",
    "_MACHINE_ID": "f87309e9541c43a38f8513b76ba08389",
    "_HOSTNAME": "development-work-05",
    "_SYSTEMD_SLICE": "system.slice",
    "SYSLOG_FACILITY": "3",
    "_TRANSPORT": "stdout",
    "_STREAM_ID": "5d84bcee51434cbcad7b2b615c666520",
    "SYSLOG_IDENTIFIER": "kubelet",
    "_PID": "11325",
    "_COMM": "kubelet",
    "_EXE": "/usr/bin/kubelet",
    "_CMDLINE": "/usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --container-runtime-endpoint=unix:///run/containerd/containerd.sock --pod-infra-container-image=registry.k8s.io/pause:3.9 --container-runtime=remote --pod-infra-container-image=sealos.hub:5000/pause:3.9 --runtime-request-timeout=15m --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock --image-service-endpoint=unix:///var/run/image-cri-shim.sock",
    "_SYSTEMD_CGROUP": "/system.slice/kubelet.service",
    "_SYSTEMD_UNIT": "kubelet.service",
    "MESSAGE": "I0214 15:03:24.189667   11325 kubelet_pods.go:897] \"Unable to retrieve pull secret, the image pull may not succeed.\" pod=\"sit/foobar-ipipe-websocket-5fbdb8b947-tm5st\" secret=\"\" err=\"secret \\\"oschub\\\" not found\""
  },
  {
    "timestamp": "2025-02-14T07:15:31.281951Z",
    "PRIORITY": "6",
    "_UID": "0",
    "_GID": "0",
    "_CAP_EFFECTIVE": "3fffffffff",
    "_BOOT_ID": "e3c57e797d354858acbab8d8892785ca",
    "_MACHINE_ID": "f87309e9541c43a38f8513b76ba08389",
    "_HOSTNAME": "development-work-05",
    "_SYSTEMD_SLICE": "system.slice",
    "SYSLOG_FACILITY": "3",
    "_TRANSPORT": "stdout",
    "_STREAM_ID": "471e83215450443ca557faff9ac3c9e4",
    "SYSLOG_IDENTIFIER": "containerd",
    "_PID": "10719",
    "_COMM": "containerd",
    "_EXE": "/usr/bin/containerd",
    "_CMDLINE": "/usr/bin/containerd",
    "_SYSTEMD_CGROUP": "/system.slice/containerd.service",
    "_SYSTEMD_UNIT": "containerd.service",
    "MESSAGE": "time=\"2025-02-14T15:15:31.281713489+08:00\" level=warning msg=\"Failed to get podSandbox status for container event for sandboxID \\\"706b42570be1ed2e30b1bb822fe646458f5ba6b664dd0b4c06c5689c52af1bd8\\\": an error occurred when try to find sandbox: not found. Sending the event with nil podSandboxStatus.\""
  }
]