Add processor to tag fluent-bit logs with metadata using k8sprocessor

[sumo-drosiek]

Is your feature request related to a problem? Please describe.

Pod logs on the k8s node are named using four attributes:

• pod_name
• namespace
• container_name
• docker_id

The name of the log is passed as part of the fluent.tag by the fluentforwarderreceiver.

Unfortunately there is no pod ip which is used by the k8sprocessor to tag logs with metadata

In order to use fluentbit and k8sprocessor in kubernetes environment the fluentd tag should be converted to the ip somehow.

Describe the solution you'd like

My idea consists of two parts:

I want to split the fluent.tag on several attributes like pod_name, namespace etc, like fluentd kubernetes plugin does do it:

pod_name, container_id and container_name are retrieved locally from the log file names

I want put that functionality into separate processor named fluentbitk8sprocessor.

After attributes are extracted, the pair namespace, pod_name should be used either:

• to retrieve metadata by k8s processor (require changes in k8sprocessor)
• to retrieve pod ip from the k8s api, so k8s processor can be used in current shape (require using kubeclient so unnecessary complicates proposed processor)

I would love to provide PR with the solution, but want to clarify proper path of extracting metadata by the k8sprocessor (adding extraction by pod name and namespace or took the ip by the proposed processor) first

Describe alternatives you've considered

Moving extraction of fields to fluentdforwarder receiver but I'm not a fan of this solution

Additional context
N/A

[pmm-sumo]

This is going to be possible very soon with attributes processor (see here)

I.e. for following config:

  attributes:
    actions:
      - key: fluent.tag
        action: extract
        pattern: (?P<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9](?:[-a-z0-9]*[a-z0-9])?)*)_(?P<namespace_name>[^_]+)_(?P<container_name>.+)-(?P<docker_id>[a-z0-9]{64})\.log$

We can extract attributes like following:

     -> fluent.tag: STRING(collection-kube-state-metrics-bff7f888d-wbd5c_test_kube-state-metrics-1c03625d46cdf4f23a727a737867db7df8b2fdd4f1308d3e0d618f6ec89df462.log)
     -> pod_name: STRING(collection-kube-state-metrics-bff7f888d-wbd5c)
     -> namespace_name: STRING(test)
     -> container_name: STRING(kube-state-metrics)
     -> docker_id: STRING(1c03625d46cdf4f23a727a737867db7df8b2fdd4f1308d3e0d618f6ec89df462)

[sumo-drosiek]

perfecto, still the question is how to get metadata using k8sprocessor without pod ip

[pmm-sumo]

perfecto, still the question is how to get metadata using k8sprocessor without pod ip

I am leaning towards using podName. Working on a proposal, should have it early next week

[github-actions]

This issue has been inactive for 60 days. It will be closed in 120 days if there is no activity.