We are doing clusterlogforwarding towards splunk and deduplicating the messages through suppression.
I have the impression that the logs in the hpe csi driver coming from the array are not properly structured, eg.:
{ [[-]](URI)
file: /var/log/pods/hpe-csi-driver_hpe-csi-driver-operator-7896f49567-j4ljp_235f4bb7-b982-4f06-a697-891d9b05c97a/hpe-csi-operator/0.log
hostname: xxxx
kubernetes: { [[+]](URI/en-GB/app/search/search?q=search%20index%20%3D%20mavenir&display.page.search.mode=verbose&dispatch.sample_ratio=1&earliest=-24h%40h&latest=now&sid=1718118498.265082_DB1E01EA-713E-4B58-BE51-5AC3AAEE526A#)
}
level: error
log_type: application
message: {"level":"error","ts":"2024-06-11T15:08:17Z","msg":"Reconciler error","controller":"hpecsidriver-controller","object":{"name":"csi-driver","namespace":"hpe-csi-driver"},"namespace":"hpe-csi-driver","name":"csi-driver","reconcileID":"ca0af16d-cda3-4691-af5b-bc3e33fd655d","error":"failed to get candidate release: values don't meet the specifications of the schema(s) in the following chart(s):\nhpe-csi-driver:\n- disable: Additional property alletraStorageMP is not allowed\n","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:329\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:235"}
openshift: { [[+]](URI/en-GB/app/search/search?q=search%20index%20%3D%20mavenir&display.page.search.mode=verbose&dispatch.sample_ratio=1&earliest=-24h%40h&latest=now&sid=1718118498.265082_DB1E01EA-713E-4B58-BE51-5AC3AAEE526A#)
}
}
[Show as raw text](URI/en-GB/app/search/search?q=search%20index%20%3D%20mavenir&display.page.search.mode=verbose&dispatch.sample_ratio=1&earliest=-24h%40h&latest=now&sid=1718118498.265082_DB1E01EA-713E-4B58-BE51-5AC3AAEE526A#)
In message expect to have the content of msg=
Can you improve on this? It's eating our splunk license quite a bit
Hi,
We are doing clusterlogforwarding towards splunk and deduplicating the messages through suppression.
I have the impression that the logs in the hpe csi driver coming from the array are not properly structured, eg.:
In message expect to have the content of msg=
Can you improve on this? It's eating our splunk license quite a bit