help request: The parser cannot found

[alvin1]

Describe the issue

We deploy the fluent-operator in the namespace named: "fluent", chart version "2.3.0". The image of fluent-bit is "kubesphere/fluent-bit:v2.1.8". We set the "containerRuntime" to "containerd". Keep other settings as default.

I have another namespace called "test". I created following resources using CRDs:

apiVersion: fluentbit.fluent.io/v1alpha2
kind: FluentBitConfig
metadata:
  name: fluentbit-config
  labels:
    app.kubernetes.io/name: fluent-bit
    argocd.argoproj.io/instance: fluent-operator
spec:
  parserSelector:
    matchLabels:
      project: catalogue
  filterSelector:
    matchLabels:
      project: catalogue
  outputSelector:
    matchLabels:
      project: catalogue
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: Parser
metadata:
  name: log-parser
  labels:
    project: catalogue
spec:
  json:
    timeFormat: "%Y-%m-%dT%H:%M:%S.%f"
    timeKeep: true
    timeKey: "@timestamp"
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: Filter
metadata:
  name: log-filter
  labels:
    project: catalogue
spec:
  match: kube.*
  filters:
    - kubernetes:
        labels: true
    - parser:
        keyName: log
        parser: log-parser
---
apiVersion: fluentbit.fluent.io/v1alpha2
kind: Output
metadata:
  name: log-output-stdout
  labels:
    project: catalogue
spec:
  matchRegex: kube.*
  stdout:
    format: json

After I deployed in my namespace, the fluent-bit daemon sets reported following error:

[2023/09/12 07:20:28] [error] [filter:parser:parser.14] requested parser 'log-parser-99f5fefc6147c28dcfdfad44c44c8105-99f5fefc6147c28dcfdfad44c44c8105-99f5fefc6147c28dcfdfad44c44c8105-99f5fefc6147c28dcfdfad44c44c8105' not found
[2023/09/12 07:20:28] [error] [filter:parser:parser.14] Invalid 'parser'
[2023/09/12 07:20:28] [error] Failed initialize filter parser.14
[2023/09/12 07:20:28] [error] [engine] filter initialization failed

How did you install fluent operator?

We deploy the fluent-operator in the namespace named: "fluent", chart version "2.3.0". The image of fluent-bit is "kubesphere/fluent-bit:v2.1.8". We set the "containerRuntime" to "containerd". Keep other settings as default.

Additional context

I also wondering why the parser name I specificed is "log-parser" but the the parser name in error message have the guid in the name, it even repeated 4 times.

The build-in parsers will disappear when we create any Parser in my own namespace.

[wenchajun]

Can you show the secret fluentbit-config?

[alvin1]

Hi, sorry for the late reply. Here's the content of secret (parsers.conf):

[PARSER]
    Name    log-parser-99f5fefc6147c28dcfdfad44c44c8105
    Format    json
    Time_Key    @timestamp
    Time_Format    %Y-%m-%dT%H:%M:%S.%f
    Time_Keep    true

[marco-giovannini-73team]

I get same issue with a built-in parser.

apiVersion: fluentbit.fluent.io/v1alpha2
kind: Filter
metadata:
  labels:
    fluentbit.fluent.io/enabled: "true"
  name: filter-app1
  namespace: customer1
spec:
  match: "*"
  filters:
 .
 .
  - parser:
      keyName: raw_event
      parser: json
.
.

[2024/06/07 14:58:20] [error] [filter:parser:parser.12] Invalid 'parser' [2024/06/07 14:58:20] [error] Failed initialize filter parser.12 [2024/06/07 14:58:20] [error] [engine] filter initialization failed [2024/06/07 14:58:20] [error] [lib] backend failed [2024/06/07 14:58:21] [ info] [input] pausing systemd.0 [2024/06/07 14:58:21] [ info] [input] pausing tail.1 level=error time=2024-06-07T14:58:21Z msg="Fluent bit exited" error="exit status 255"