Fluentd + Kubernetes：基于标签隔离日志

问题描述

我想对在Kubernetes上部署的Java应用程序的日志应用concat过滤器，以将多行日志（不仅是异常）连接为一个日志事件。

这是修复问题后的最终工作版本。

想法是为部署添加标签

metadata:
  ...
spec:
  ...
  template:
    metadata:
      labels:
        logtype: springboot

有效的配置：

# rewrite tag of events with kubernetes label kubernetes.labels.logtype=springboot
#
# it is important to change the tag. If the tag is not modified the event will be
# reemitted with the same tag and matched again by the rewrite tag filter -> infinite loop
<match kubernetes.var.log.containers.**>
  @type rewrite_tag_filter
  @log_level debug
  <rule>
    key $.kubernetes.labels.logtype
    pattern /^springboot$/
    tag springboot.${tag}
  </rule>
  # the rewrite tag filter is an event sink. Events that are not reemitted by the plugin
  # are gone. So we need a catch-all rule to reemitt any event that is not caught
  # by the spring boot rule.
  <rule>
    key log
    pattern /^.*$/
    # and the tag must be changed so that the event will skip the rewrite filter after reemitting
    tag unmatched.${tag}
  </rule>
</match>

# Handle multiline logs for springboot logs.
<filter springboot.**>
  @type concat
  key log
  separator ""
  multiline_start_regexp /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}\  (ERROR|WARN|INFO|DEBUG|TRACE)/
</filter>

解决方法

1. <match **/>-这可能是拼写错误，或者是无效的流利配置
2. 我需要确定完整的配置，但是<match **>在到达<match springboot.**>之前也将与重写的标签匹配。为避免这种情况，请在**匹配项之前放置match弹簧靴，或将**匹配项缩小到来自kube的内容，例如<match kube.**>。重新标记的事件被注入到管道的开头，并按照它们在配置中出现的顺序遍历各个部分。