Skip to content

Instantly share code, notes, and snippets.

@andycmaj

andycmaj/fluentd_nested_json.conf

Created October 12, 2021 00:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save andycmaj/54f2a290fe60bb6d868af25a7f9b5bf4 to your computer and use it in GitHub Desktop.
Save andycmaj/54f2a290fe60bb6d868af25a7f9b5bf4 to your computer and use it in GitHub Desktop.
Download ZIP
fluentd filter config for parsing nested json log messages in k8s-plugin-enriched entries
Raw
fluentd_nested_json.conf
# Fixes parsing nested json in the docker json logs
<filter kubernetes.**>
@id filter_parser
@type parser
key_name log
reserve_data false
remove_key_name_field true
# use parent @timestamp if can't parse a time field
replace_invalid_sequence true
reserve_time true
# prefix parsed nested json fields with "data."
inject_key_prefix data.
<parse>
@type multi_format
<pattern>
format json
json_parser json
</pattern>
<pattern>
format none
</pattern>
</parse>
</filter>
@andycmaj
Copy link
Author

investigation from:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment