Fluentd-kubernetes-daemonset: JSON parser not working

Created on 22 Feb 2019  路  2Comments  路  Source: fluent/fluentd-kubernetes-daemonset

I'm trying to parse following log as JSON (Note: sample ouput is from console, not from the docker container log files)

Environment:
Fluentd image: fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-elasticsearch-1.3
Elasticsearch: v6.6

{"level":"info","msg":"this is a test log - json","time":"2019-02-22T14:36:05Z"}
time="2019-02-22T14:36:05Z" level=info msg="this is a test log"
this is a test log
{"level":"info","msg":"this is a test log - json","time":"2019-02-22T14:36:15Z"}
time="2019-02-22T14:36:15Z" level=info msg="this is a test log"
this is a test log
this is a test log
{"level":"info","msg":"this is a test log - json","time":"2019-02-22T14:36:25Z"}
time="2019-02-22T14:36:25Z" level=info msg="this is a test log"

This is my custom parser config which is mounted as config map in the fluentd pod. This is working as expected as I see the filter in the fluentd config.

<filter kubernetes.**>
   @type parser
   <parse>
      @type json
      json_parser json
   </parse>
   replace_invalid_sequence true
   emit_invalid_record_to_error false
   key_name log
   reserve_data true
</filter>

But if I activate this filter, I can't see the JSON logs in Kibana anymore.
Here is the screenshot from Kibana. As you can see, the JSON log seems supressed / ignored. While the "normal" logs and Sysout log are displayed as usual.
image

There are some similar Issues, but none of them help me.

193

181

Most helpful comment

Finally figured out the correct configuration.

<filter kubernetes.var.log.containers.**>
  @type parser
  format json
  key_name log
  reserve_time true
  reserve_data true
  emit_invalid_record_to_error false
</filter>

image

All 2 comments

No error/warning log in Elasticsearch?
{...} is object type and others seems text type.

Finally figured out the correct configuration.

<filter kubernetes.var.log.containers.**>
  @type parser
  format json
  key_name log
  reserve_time true
  reserve_data true
  emit_invalid_record_to_error false
</filter>

image

Was this page helpful?
0 / 5 - 0 ratings

Related issues

jpds picture jpds  路  9Comments

abh picture abh  路  11Comments

pranavmarla picture pranavmarla  路  7Comments

pckhoi picture pckhoi  路  4Comments

AndrewBoklashko picture AndrewBoklashko  路  10Comments