Kubernetes Filter

The Kubernetes Filter allows to enrich your log files with Kubernetes metadata.

When Fluent Bit is deployed in Kubernetes as a DaemonSet and configured to read the log files from the containers (using tail plugin), this filter aims to perform the following operations:

  • Analyze the Tag and extract the following metadata:
    • POD Name
    • Namespace
    • Container Name
    • Container ID
  • Query Kubernetes API Server to obtain extra metadata for the POD in question:
    • POD ID
    • Labels
    • Annotations

The data is cached locally in memory and appended to each record.

Configuration Parameters

The plugin supports the following configuration parameters:

Key Description Default
Buffer_Size Set the buffer size for HTTP client when reading responses from Kubernetes API server. The value must be according to the Unit Size specification. 32k
Kube_URL API Server end-point https://kubernetes.default.svc.cluster.local:443
Kube_CA_File CA certificate file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
Kube_CA_Path CA path
Kube_Token_File Token file /var/run/secrets/kubernetes.io/serviceaccount/token
Merge_Log When enabled, it checks if the log field content is a JSON string map, if so, it append the map fields as part of the log structure. Off
tls.debug Debug level between 0 (nothing) and 4 (every detail). -1
tls.verify When enabled, turns on certificate validation when connecting to the Kubernetes API server. On
Use_Journal When enabled, the filter reads logs coming in Journald format. Off
Regex_Parser Set an alternative Parser to process record Tag and extract pod_name, namespace_name, container_name and docker_id. The parser must be registered in a parsers file (refer to parser filter-kube-test as an example).

results matching ""

    No results matching ""