Splunk-connect-for-kubernetes: Could we redirect a specific container log an an Index

[aakashbhalla1]

Could we redirect a specific container log an an Index

Let me know if you need details.

[aakashbhalla1]

Also for a native log format could we add a field for IndexName

logs:
nginx-access:
from:
file:
path: "/var/log/nginx-containers/host.access.log"
sourcetype: "nginx:access"
indexName: "nginx"

[aakashbhalla1]

fluentd:monitor-agent are only going to default index there are no provision to put an indexName field to it.

[matthewmodestino]

Hi aakashbhalla1!

You definitely can, using fluentd filters and our built in jq_transformer, you can dynamically set the index based on various variables that fluentd tags the log with as it moves through the pipeline.

Will work on getting a good reference doc and how-to to help users learn and extend their config, and will see how much of it we can expose via helm, vs directly editing the templates.

[alanzchan]

Hi,

I'm having the same issue. I see that we can only define sourcetypes in values.yaml. Do you have any examples or documentation that details how to route different container logs to separate indexes?

[alanzchan]

Just wanted to follow up on this issue. I was wondering if there were any updates.

[rockb1017]

resolved as part of #294