PodLoggingConfig

Scope: Namespaced
Version: v1alpha1

Custom resource for namespaced Kubernetes source.

Each custom resource PodLoggingConfig describes rules for log fetching from specified namespace.

  • spec
    object

    Required value

    • spec.clusterDestinationRefs
      array of strings

      Required value

      Array of ClusterLogDestination custom resource names which this source will output with.

    • spec.keepDeletedFilesOpenedFor
      string

      Specifies the time to keep deleted files opened for reading. Vector will keep pods metadata for this time as well to read logs from deleted pods. This option is useful in cases of a log storage unavailability or a network partition. Vector will keep log files opened until finally sending them to the destination.

      Enabling this option may affect the resource consumption of the Vector and also flood a disk with deleted logs. Use it with caution.

      The format is a string containing the time unit in hours and minutes: 30m, 1h, 2h30m, 24h.

      Pattern: ^([0-9]+h([0-9]+m)?|[0-9]+m)$

    • spec.labelFilter
      array of objects

      Rules to filter log lines by their metadata labels.

      Example:

      labelFilter:
- field: container
  operator: In
  values:
  - nginx
- field: pod_labels.tier
  operator: Regex
  values:
  - prod-.+
  - stage-.+
- field: message
  operator: Regex
  values:
  - ".*search_text.*"
      • spec.labelFilter.field
        string

        Required value

        Label name for filtering.

        Must not be empty.

        Pattern: .+

      • spec.labelFilter.operator
        string

        Required value

        Operator for log field comparations:

        • In — finds a substring in a string.
        • NotIn — is a negative version of the In operator.
        • Regex — is trying to match regexp over the field; only log events with matching fields will pass.
        • NotRegex — is a negative version of the Regex operator; log events without fields or with not matched fields will pass.
        • Exists — drops log event if it contains some fields.
        • DoesNotExist — drops log event if it does not contain some fields.

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.labelFilter.values
        array

        Array of values or regexes for corresponding operations. Does not work for Exists and DoesNotExist operations.

        Fields with a float or boolean values will be converted to strings during comparison.

    • spec.labelSelector
      object

      Specifies the label selector to filter Pods.

      You can get more into here.

      • spec.labelSelector.matchExpressions
        array of objects

        List of label expressions for Pods.

        Example:

        matchExpressions:
- key: tier
  operator: In
  values:
  - production
  - staging
        • spec.labelSelector.matchExpressions.key
          string

          A label name.

        • spec.labelSelector.matchExpressions.operator
          string

          A comparison operator.

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.labelSelector.matchExpressions.values
          array of strings

          A label value.

          • Element of the array
            string

            Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?

            Length: 1..63

      • spec.labelSelector.matchLabels
        object

        List of labels which Pod should have.

        Example:

        matchLabels:
  foo: bar
  baz: who
    • spec.logFilter
      array of objects

      A list of filters for logs that are applied to messages in JSON format.

      Only matched lines would be stored to log destination.

      Example:

      logFilter:
- field: tier
  operator: Exists
- field: foo
  operator: NotIn
  values:
  - dev
  - 42
  - 'true'
  - '3.14'
- field: bar
  operator: Regex
  values:
  - "^abc"
  - "^\\d.+$"
      • spec.logFilter.field
        string

        Required value

        Field name for filtering. It should be empty for non-JSON messages.

      • spec.logFilter.operator
        string

        Required value

        Operator for log field comparations:

        • In — finds a substring in a string.
        • NotIn — is a negative version of the In operator.
        • Regex — is trying to match regexp over the field; only log events with matching fields will pass.
        • NotRegex — is a negative version of the Regex operator; log events without fields or with not matched fields will pass.
        • Exists — drops log event if it contains some fields.
        • DoesNotExist — drops log event if it does not contain some fields.

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.logFilter.values
        array

        Array of values or regexes for corresponding operations. Does not work for Exists and DoesNotExist operations.

        Fields a with float or boolean values will be converted to strings during comparison.

    • spec.multilineParser
      object

      Multiline parser for different patterns.

      • spec.multilineParser.custom
        object

        Multiline parser custom regex rules.

        • spec.multilineParser.custom.endsWhen
          object

          It’s a condition to distinguish the last log line of the multiline log.

          • spec.multilineParser.custom.endsWhen.notRegex
            string

            Regex string, which treats as match only strings that DON’T match the regex.

          • spec.multilineParser.custom.endsWhen.regex
            string

            Regex string, which treats as match only strings that match the regex.

        • spec.multilineParser.custom.startsWhen
          object

          It’s a condition to distinguish the first log line of multiline log.

          • spec.multilineParser.custom.startsWhen.notRegex
            string

            Regex string, which treats as match only strings that DON’T match the regex.

          • spec.multilineParser.custom.startsWhen.regex
            string

            Regex string, which treats as match only strings that match the regex.

      • spec.multilineParser.type
        string

        Required value

        Parser types:

        • None — do not parse logs.
        • General — tries to match general multiline logs with space or tabulation on extra lines.
        • Backslash — tries to match bash style logs with backslash on all lines except the last event line.
        • LogWithTime — tries to detect events by timestamp.
        • MultilineJSON — tries to match JSON logs, assuming the event starts with the { symbol.
        • Custom - tries to match logs with the user provided regex in spec.multilineParser.custom field.

        Default: "None"

        Allowed values: None, General, Backslash, LogWithTime, MultilineJSON, Custom