namespaces_regex not working in ClusterFlow - logs from all namespaces being routed incorrectly

[dejanmarich]

Bugs should be filed for issues encountered whilst operating logging-operator.
You should first attempt to resolve your issues through the community support
channels, e.g. Slack, in order to rule out individual configuration errors. #logging-operator
Please provide as much detail as possible.

Describe the bug:
The namespaces_regex field in ClusterFlow specifications is completely ignored by the fluent-plugin-label-router, causing logs from all namespaces to be incorrectly routed to outputs that should only receive logs from specific namespace patterns. Despite proper configuration with both regex patterns and explicit namespace lists, Fluentd generates warning "parameter 'namespaces_regex' in is not used" and routes all cluster logs to the wrong destination.

Expected behaviour:
ClusterFlow configured with e.g. namespaces_regex: ["^redis-.*"] should only route logs from namespaces that start with "redis-" (like redis-us-east-01, redis-sentinel, etc.) to the specified Kafka topic. Logs from other namespaces (kube-system, monitoring, openebs) should be routed according to their respective ClusterFlow configurations or be discarded if no matching flow exists.

Steps to reproduce the bug:

• Install logging-operator 5.3.0 with Fluentd v1.17-5.0-full-build.207 and FluentBit 4.0.3
• Create a ClusterFlow with namespaces_regex pattern:

apiVersion: logging.banzaicloud.io/v1beta1
kind: ClusterFlow
metadata:
  name: redis-logs
  namespace: logging
spec:
  match:
  - select:
      namespaces_regex:
      - "^redis-.*"
  globalOutputRefs:
  - redis-logs-output

• Create a ClusterOutput pointing to a Kafka topic
• Deploy configuration and observe Fluentd logs
• Check the destination Kafka topic - it will contain logs from ALL namespaces, not just Redis ones
• Observe Fluentd warning: "parameter 'namespaces_regex' in is not used"
  Additional context:
• The same issue occurs with explicit namespace lists (namespaces: ["redis-us-east-01"])
• fluent-plugin-label-router version 0.4.0 is installed, which should support namespaces_regex
• The generated Fluentd configuration shows correct syntax: namespaces_regex redis-.*
• Buffer files show excessive log volume (400KB+ files) indicating all logs are being processed
• Tested with both ^redis-.* and redis-.* patterns - both fail
• CRDs correctly expose the namespaces_regex field
• Sample log from wrong namespace in Redis kafka topic:

{
  "kubernetes": {
    "namespace_name": "kube-system",
    "pod_name": "hubble-ui-76599dbc7c-p8bw9"
  }
}

Environment details:

• Kubernetes version: v1.30
• Cloud-provider/provisioner: On-premises cluster
• logging-operator version: 5.3.0
• Install method: Helm chart via ArgoCD
• Logs from the misbehaving component:

2025-06-04 13:35:33 +0000 [warn]: parameter 'namespaces_regex' in <match>
</match> is not used.
2025-06-04 09:28:03 +0000 [info]: gem 'fluent-plugin-label-router' version '0.4.0'

Resource definition that caused the issue:

apiVersion: logging.banzaicloud.io/v1beta1
kind: ClusterFlow
metadata:
  name: redis-logs
  namespace: logging
spec:
  filters:
  - record_modifier:
      prepare_value: |
        require 'time'
      records:
      - '@timestamp': ${Time.at(time).utc.strftime('%Y-%m-%dT%H:%M:%S.%LZ')}
  globalOutputRefs:
  - redis-logs-output
  match:
  - select:
      namespaces_regex:
      - redis-.*
---
apiVersion: logging.banzaicloud.io/v1beta1
kind: ClusterOutput
metadata:
  name: redis-logs-output
  namespace: logging
spec:
  kafka:
    brokers: kafka1:9092,kafka2:9092
    default_topic: logs-redis-sandbox
    format:
      type: json

/kind bug