search

fabric8io / fluent-plugin-kubernetes_metadata_filter

Enrich your fluentd events with Kubernetes metadata
Apache License 2.0
350 stars 166 forks source link

some abnormal log lack some fields #336

Closed AkitoZz closed 2 years ago

AkitoZz commented 2 years ago

when is use fluentd(1.3.3) with metadata_filter plugin(2.4.1), i met some trouble and i dont know how does it caused. this picture shows a piece of abnormal log that lacked "pod_name" and "containerimage" fields ![Uploading 1061653996834.pic.jpg…]()

and this picture show a normal log, it has "pod_name" and "containerimage" fields ![Uploading 1051653996834.pic.jpg…]()

How this condition arises and how could i fix it, thx

jcantrill commented 2 years ago

namespace, pod_name and depending upon which path is being followed containername/container_hash are fields that are discoverable by the filename which becomes the tag passed to the plugin. These are the minimum bits one could have if the API call fails. container_image requires a successful API call. If you are not getting pod_name it is likely incoming tag is not coming from a valid kubernetes locations which would be /var/log/pods or /var/log/containers

AkitoZz commented 2 years ago

sorry i made a mistake, lacked fields are "container_image" and "host", are they both caused by API call failures? maybe i should see k8s log to find some api call failures information? and whether the plugin has a retry mechanism to comfirm that the api call is successful, there is only a few logs lack these fields

jcantrill commented 2 years ago

"container_image" and "host" I encourage you to review the code to see what meta is provided by this plugin. I don't believe 'host' is ever provided but in our configuration is passed to the fluent instance via an environment variable given it would run on the same host as the collector. This assumes you are normalizing logs from the same host and not doing so from feeding logs via something like the forward protocol.