fluentd.md

Fluentd parser for Kubernetes Nginx Ingress

    <match kubernetes.**>
      @id kubernetes_nginx_tag
      @type rewrite_tag_filter
      @log_level trace
      <rule>
        key kubernetes_container_name
        pattern /^ingress-nginx$/
        tag kubernetes.nginx
      </rule>
    </match>
    <filter kubernetes.nginx.**>
      @id nginx_log_parser
      @type parser
      @log_level debug
      key_name message
      reserve_data true
      <parse>
        @type nginx
        expression /"(?<remote_addr>[^ ]*) - \[(?<proxy_protocol_addr>[^ ]*)\] - (?<remote_user>[^ ]*) \[(?<time>[^\]]*)\] \\"(?<method>\S+[^ ]) (?<request>[^ ]*) (?<protocol>[^ ]*)\\" (?<code>[^ ]*) (?<size>[^ ]*) \\"(?<refer>[^ ]*?)\\" \\"(?<http_user_agent>[^ ].*)\\" (?<request_length>[^ ]*) (?<request_time>[^ ]*) \[(?<proxy_upstream_name>[^ ]*)\] (?<upstream_addr>[^ ]*) (?<upstream_resp_length>[^ ]*) (?<upstream_resp_time>[^ ]*) (?<upstream_status>[^ ]*) (?<req_id>[^ ]*)/
        time_format %d/%b/%Y:%H:%M:%S %z
      </parse>
    </filter>