Splunk-connect-for-kubernetes: Source typing container logs

[sayeedc]

Right now, source types are derived from the container or pod name. Are there any plans to provide the option for users to set the source type? This allows users to create the same containers with a common source type rather different ones. I've seen over 1000 sourcetypes created on a single cluster.

[matthewmodestino]

Hey Sayeed!

Technically you can set the sourcetype by customizing the jq_transformer filter in the logging configmap:

https://github.com/splunk/splunk-connect-for-kubernetes/blob/ec00d8fcf6b4030cca0ea434d8b54a606add85d0/manifests/splunk-kubernetes-logging/configMap.yaml#L180

Ideally, in the future I'd like to see us support setting the sourcetype, among other options in annotations.

How would you like to see the sourcetypes implemented? Would docs on using the jq_transformer suffice for now?

[sayeedc]

Hey Matt

Ideally, I'd like the users to set the sourcetype from Openshift (maybe via labels or annotations) since how containers are named is controlled by them. It can be anything, which makes setting source types via jq difficult.

[chaitanyaphalak]

Currently a user can set the sourcetype using https://github.com/splunk/splunk-connect-for-kubernetes/blob/develop/helm-chart/splunk-kubernetes-logging/values.yaml#L108
I know its static, for setting sourcetypes dynamically through labels and annotations will require a significant overhaul of the current implementation.

[rockb1017]

resolved as part of #294