Kubernetes

Overview

This input type allows you to specify Kubernetes pods and namespaces for Edge Delta to monitor.

Example

 kubernetes:
    - labels: "nginx,errorcheck"
      include:
        - "pod=^nginx.*$,kind=ReplicaSet,namespace=default,container-name=nginx,container-image=docker.io/nginx:latest,labels.my_app=abc"
      exclude: # exclude has higher priority
        - "namespace=^kube-system$"
    - labels: "apache,errorcheck"
      include:
        - "pod=^apache.*$,namespace=.*web*"
      exclude: # exclude has higher priority
        - "namespace=^kube-nginx$"
        - "pod=.*nginx*,kind=StatefulSet"
    - labels: "k8s with enrichment dynamic fields from labels"
      include:
        - "pod=flog,namespace=default"
      filters:
      - enrichment-failure-behavior
    - labels: "k8s with enrichment aws metadata"
      include:
        - "pod=flog,namespace=default"
      filters:
      - enrichment-aws

Parameters

labels

Required

Enter a descriptive label for this input. When you create a workflow, you will use this label to enter your input into the workflow.

labels: "apache,errorcheck"

exclude

Optional

If exclude is specified it drops some logs that match its regex rules. To specify which input to add, you must provide a regex pattern. Comma separated values indicate AND rules, while separate rules indicate OR matching. In this example logs that match rule-1 and rule-2 are excluded. Logs that match rule-3 are also excluded. A log matching only rule-1 would not be excluded.

• If neither include nor exclude are specified, then everything from the input is passed.
• If include is specified as well as exclude, then logs matching in include are passed unless they are dropped by exclude.

inputs:
  kubernetes:
    - labels: "<input name>"
      exclude:
        - "rule-1,rule-2"
        - "rule-3"

The following values can be excluded from a Kubernetes input:

• pod
• kind
• namespace
• container-name
• container-image
• labels

include

Optional

If include is specified it only passes matching logs, dropping all others. It is specified with a regex pattern. Comma separated values indicate AND rules, while separate rules indicate OR matching. In this example logs that match rule-1 and rule-2 are excluded. Logs that match rule-3 are also excluded. A log matching only rule-1 would not be excluded.

• If neither include nor exclude are specified, then everything from the input is passed.
• If include is specified as well as exclude, then logs matching in include are passed unless they are dropped by exclude.

inputs:
  kubernetes:
    - labels: "<input name>"
      include:
        - "rule-1,rule-2"
        - "rule-3"

The following values can be included in a Kubernetes input:

• pod
• kind
• namespace
• container-name
• container-image
• labels

auto_detect_line_pattern

Optional

Enter true or false to enable auto line detection for log messages with multiple lines.

auto_detect_line_pattern: true

boost_stracktrace_detection

Optional

Enter true or false to enhance (or troubleshoot missed patterns) the Auto Line Detection parameter.

boost_stacktrace_detection: true

filters

Optional

Enter an existing filter to add to this input. In addition to the Kubernetes-specific filters that you can configure, you can also use universal filters, such as regex, that are applicable to most inputs.

You can use a filter to discard unnecessary logs or protect sensitive data. As a result, filters can help reduce the agent’s resource load because of the reduced log ingestion.

To use a universal filter, you must:

1. Create a filter

filters:
  - name: regex-error-doc-example
    type: regex
    pattern: error|ERROR|ERR|Err

2. Add the filter to the input

 kubernetes:
    - labels: "nginx,errorcheck"
      include:
        - "pod=^nginx.*$,kind=ReplicaSet,namespace=default,container-name=nginx,container-image=docker.io/nginx:latest,labels.my_app=abc"
      exclude: # exclude has higher priority
        - "namespace=^kube-system$"
      filters: 
        - info 
        - regex-error-doc-example

To learn more about universal filters, see Filters.