configuring mtail as a node-level logging-agent on kubernetes

counter.mtail

counter lines_with_a_total
counter lines_without_a_total
counter lines_total

/(.*)/ {
  $1 =~ /a/ {
    lines_with_a_total++
  }
  $1 !~ /a/ {
    lines_without_a_total++
  }
  lines_total++
}

daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: mtail
  labels:
    app: mtail
spec:
  selector:
    matchLabels:
      app: mtail
  template:
    metadata:
      labels:
        app: mtail
    spec:
      containers:
      - name: mtail
        image: xinau/mtail:latest
        args:
        - "--logtostderr"
        - "--logs"
        - "/var/log/*.log"
        - "--logs"
        - "/var/log/containers/*.log"
        - "--port"
        - "3903"
        - "--progs"
        - "/etc/mtail"
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 200Mi
        ports:
        - name: metrics
          containerPort: 3903
          hostPort: 3903
        volumeMounts:
        - name: varlog
          mountPath: /var/log
          readOnly: true
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
        - name: config-volume
          mountPath: /etc/mtail
      terminationGracePeriodSeconds: 30
      tolerations:
      - key: node-role.kubernetes.io/master
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: config-volume
        configMap:
          name: mtail-config

Dockerfile

FROM debian:stable AS builder

ENV MTAIL_VERSION=3.0.0-rc33

RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl && \
    curl -LsS -O https://github.com/google/mtail/releases/download/v${MTAIL_VERSION}/mtail_v${MTAIL_VERSION}_linux_amd64 && \
    mv mtail_v${MTAIL_VERSION}_linux_amd64 /usr/bin/mtail && \
    chmod 755 /usr/bin/mtail

FROM debian:stable

LABEL org.opencontainers.image.authors="Felix Ehrenpfort (@xinau)" \
      org.opencontainers.image.title="google/mtail" \
      org.opencontainers.image.version="3.0.0.-rc33"

EXPOSE 3903
ENTRYPOINT ["/usr/bin/mtail"]

COPY --from=builder /usr/bin/mtail /usr/bin/mtail

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonLabels:
  app: mtail
  version: 3.0.0-rc33
configMapGenerator:
- name: mtail-config
  files:
  - counter.mtail
images:
- name: xinau/mtail
  digest: sha256:195fcc9d4d505db291c17658db8bba771889c2f9c7cf4cd32175406f11840469
  newTag: 3.0.0-rc33
namespace: kube-system
resources:
- daemonset.yaml