kugarocks

English

简体中文

English

简体中文

Appearance

Kube Tag Prefix ​

Error ​

txt
incoming record tag (kube.containers) is shorter than kube_tag_prefix value (kube.var.log.containers.), skip filter

Reproduce ​

Set Tag to kube.foobar will trigger error.

toml
    [INPUT]
        Name tail
        Path /var/log/containers/*.log
        multiline.parser docker, cri, java-exception, go
        Tag kube.containers
        Mem_Buf_Limit 5MB
        Skip_Long_Lines On

    [FILTER]
        Name kubernetes
        Match kube.containers
        Merge_Log On
        Keep_Log Off
        Labels Off
        Annotations Off
        K8S-Logging.Parser On
        K8S-Logging.Exclude Off

Reason ​

Tail support Tags expansion, which means that if a tag have a star character (*), it will replace the value with the absolute path of the monitored file, so if you file name and path is:

txt
/var/log/containers/xxx

then the tag will be (slashes are replaced with dots):

txt
kube.var.log.containers.xxx

Next, it will use Kube_Tag_Prefix which default value is kube.var.log.containers to remove tag prefix. Then the tag will be:

txt
xxx

xxx will be use to extract namespace and pod name data by the following regex.

txt
(?<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$

So, if tag is kube.containers without * ...

Reference ​