Project: Logging Operator (Kube Logging) (Observability and Analysis / Observability)
File: fluentbit_types.md

title: FluentbitSpec weight: 200 generated_file: true FluentbitAgent is the Schema for the loggings API FluentbitAgentList contains a list of FluentbitAgent FluentbitSpec defines the desired state of FluentbitAgent Set the coroutines stack size in bytes. The value must be greater than the page size of the running system. Don't set too small value (say 4096), or coroutine threads can overrun the stack buffer. Do not change the default value of this parameter unless you know what you are doing. (default: 24576) Default: 24576 Available in Logging operator version 4.2 and later. Specify a custom parser file to load in addition to the default parsers file. It must be a valid key in the configmap specified by customConfig. Disable Kubernetes metadata filter Parameters for Kubernetes metadata filter Set the flush time in seconds.nanoseconds. The engine loop uses a Flush timeout to define when is required to flush the records ingested by input plugins through the defined output plugins. (default: 1) Default: 1 Set the grace time in seconds as Integer value. The engine loop uses a Grace timeout to define wait time on exit. Default: 5 Available in Logging operator version 4.4 and later. Set the logging verbosity level. Allowed values are: error, warn, info, debug and trace. Values are accumulative, e.g: if 'debug' is set, it will include error, warning, info and debug. Note that trace mode is only available if Fluent Bit was built with the WITH_TRACE option enabled. Default: info Deprecated, use inputTail.parser Deprecated, use positiondb FluentbitStatus defines the resource status for FluentbitAgent FluentbitTLS defines the TLS configs FluentbitTCPOutput defines the TLS configs Default: iso8601 Default: ts Available in Logging operator version 4.4 and later. FluentbitNetwork defines network configuration for fluentbit Sets the timeout for connecting to an upstream Default: 10 On connection timeout, specify if it should log an error. When disabled, the timeout is logged as a debug message Default: true Sets the primary transport layer protocol used by the asynchronous DNS resolver for connections established Default: UDP, UDP or TCP Prioritize IPv4 DNS results when trying to establish a connection Default: false Select the primary DNS resolver type Default: ASYNC, LEGACY or ASYNC Whether or not TCP keepalive is used for the upstream connection Default: true How long in seconds a TCP keepalive connection can be idle before being recycled Default: 30 How many times a TCP keepalive connection can be used before being recycled Default: 0, disabled Specify network address (interface) to use for connection and data traffic. Default: disabled BufferStorage is the Service Section Configuration of fluent-bit If storage.path is set, Fluent Bit will look for data chunks that were not delivered and are still in the storage layer, these are called backlog data. This option configure a hint of maximum value of memory to use when processing these records. Default: 5M Enable the data integrity check when writing and reading data from the filesystem. The storage layer uses the CRC32

Default: Off When enabled, irrecoverable chunks will be deleted during runtime, and any other irrecoverable chunk located in the configured storage path directory will be deleted when Fluent-Bit starts. Default: Off Available in Logging operator version 4.4 and later. If the `http_server` option has been enabled in the main Service configuration section, this option registers a new endpoint where internal metrics of the storage layer can be consumed. Default: Off Set an optional location in the file system to store streams and chunks of data. If this parameter is not set, Input plugins can only use in-memory buffering. Configure the synchronization mode used to store the data into the file system. It can take the values normal or full. Default: normal HealthCheck configuration. Available in Logging operator version 4.4 and later. The error count to meet the unhealthy requirement, this is a sum for all output plugins in a defined HC_Period. Default: 5 The time period (in seconds) to count the error and retry failure data point. Default: 60 The retry failure count to meet the unhealthy requirement, this is a sum for all output plugins in a defined HC_Period Default: 5 HotReload configuration InputTail defines FluentbitAgent tail input configuration The tail input plugin allows to monitor one or several text files. It has a similar behavior like tail -f shell command. Set the buffer size for HTTP client when reading responses from Kubernetes API server. The value must be according to the Unit Size specification. Default: 32k Set the limit of the buffer size per monitored file. When a buffer needs to be increased (e.g: very long lines), this value is used to restrict how much the memory buffer can grow. If reading a file exceed this limit, the file is removed from the monitored file list. The value must be according to the Unit Size specification. Default: BufferChunkSize Specify the database file to keep track of monitored files and offsets. sets the journal mode for databases (WAL). Enabling WAL provides higher performance. Note that WAL is not compatible with shared network file systems. Default: WAL Specify that the database will be accessed only by Fluent Bit. Enabling this feature helps to increase performance when accessing the database but it restrict any external tool to query the content. Default: true Set a default synchronization (I/O) method. Values: Extra, Full, Normal, Off. This flag affects how the internal SQLite engine do synchronization to disk, for more details about each option please refer to this section. Default: Full If enabled, the plugin will recombine split Docker log lines before passing them to any parser as configured above. This mode cannot be used at the same time as Multiline. Default: Off Wait period time in seconds to flush queued unfinished split lines. Default: 4 Specify an optional parser for the first line of the docker multiline mode. Set one or multiple shell patterns separated by commas to exclude files matching a certain criteria, e.g: exclude_path=.gz,.zip Ignores files that have been last modified before this time in seconds. Supports m,h,d (minutes, hours,days)

Default behavior is to read all specified files. When a message is unstructured (no parser applied), it's appended as a string under the key name log. This option allows to define an alternative name for that key. Default: log Set a limit of memory that Tail plugin can use when appending data to the Engine. If the limit is reach, it will be paused; when the data is flushed it resumes. If enabled, the plugin will try to discover multiline messages and use the proper parsers to compose the outgoing messages. Note that when this option is enabled the Parser option is not used. Default: Off Wait period time in seconds to process queued multiline messages Default: 4 Specify one or multiple parser definitions to apply to the content. Part of the new Multiline Core support in 1.8 Default: "" Specify the name of a parser to interpret the entry as a structured message. Name of the parser that machs the beginning of a multiline message. Note that the regular expression defined in the parser must include a group name (named capture) Optional-extra parser to interpret and structure multiline entries. This option can be used to define multiple parsers, e.g: Parser1 ab1, Parser2 ab2, Parser_N abN. Pattern specifying a specific log files or multiple ones through the use of common wildcards. If enabled, it appends the name of the monitored file as part of the record. The value assigned becomes the key in the map. For new discovered files on start (without a database offset/position), read the content from the head of the file, not tail. The interval of refreshing the list of watched files in seconds. Default: 60 Specify the number of extra time in seconds to monitor a file once is rotated in case some pending data is flushed. Default: 5 When a monitored file reach it buffer capacity due to a very long line (BufferMaxSize), the default behavior is to stop monitoring that file. SkipLongLines alter that behavior and instruct Fluent Bit to skip long lines and continue processing other lines that fits into the buffer size. Default: Off Specify the buffering mechanism to use. It can be memory or filesystem. Default: memory Set a tag (with regex-extract fields) that will be placed on lines read. Set a regex to extract fields from the file. FilterKubernetes Fluent Bit Kubernetes Filter allows to enrich your log files with Kubernetes metadata. Include Kubernetes resource annotations in the extra metadata. Default: On Set the buffer size for HTTP client when reading responses from Kubernetes API server. The value must be according to the Unit Size specification. A value of 0 results in no limit, and the buffer will expand as-needed. Note that if pod specifications exceed the buffer limit, the API response will be discarded when retrieving metadata, and some kubernetes metadata will fail to be injected to the logs. If this value is empty we will set it

Default: "0" When enabled, metadata will be fetched from K8s when docker_id is changed. Default: Off DNS lookup retries N times until the network start working Default: 6 DNS lookup interval between network status checks Default: 30 If set, use dummy-meta data (for test/dev purposes) Default: Off Allow Kubernetes Pods to exclude their logs from the log processor (read more about it in Kubernetes Annotations section). Default: On Allow Kubernetes Pods to suggest a pre-defined Parser (read more about it in Kubernetes Annotations section) Default: Off When KeepLog is disabled, the log field is removed from the incoming message once it has been successfully merged (MergeLog must be enabled as well). Default: On CA certificate file (default:/var/run/secrets/kubernetes.io/serviceaccount/ca.crt) Default: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt Absolute path to scan for certificate files Configurable TTL for K8s cached metadata. By default, it is set to 0 which means TTL for cache entries is disabled and cache entries are evicted at random when capacity is reached. In order to enable this option, you should set the number to a time interval. For example, set this value to 60 or 60s and cache entries which have been created more than 60s will be evicted. Default: 0 If set, Kubernetes meta-data can be cached/pre-loaded from files in JSON format in this directory, named as namespace-pod.meta When the source records comes from Tail input plugin, this option allows to specify what's the prefix used in Tail configuration. (default:kube.var.log.containers.) Default: kubernetes.var.log.containers Token file (default:/var/run/secrets/kubernetes.io/serviceaccount/token) Default: /var/run/secrets/kubernetes.io/serviceaccount/token Token TTL configurable 'time to live' for the K8s token. By default, it is set to 600 seconds. After this time, the token is reloaded from KubeTokenFile or the KubeTokenCommand. (default:"600") Default: 600 API Server end-point. Default: https://kubernetes.default.svc:443 kubelet port using for HTTP request, this only works when Use_Kubelet set to On Default: 10250 Include Kubernetes resource labels in the extra metadata. Default: On Match filtered records (default:kube.*) Default: kubernetes.* When enabled, it checks if the log field content is a JSON string map, if so, it append the map fields as part of the log structure. (default:Off) Default: On When MergeLog is enabled, the filter tries to assume the log field from the incoming message is a JSON string message and make a structured representation of it at the same level of the log field in the map. Now if MergeLog_Key is set (a string name), all the new structured fields taken from the original log content are inserted under the new key. When Merge_Log is enabled, trim (remove possible \n or \r) field values. Default: On Optional parser name to specify how to parse the data contained in the log key. Recommended use is for developers or testing only. Include Kubernetes namespace annotations on every record Configurable TTL for K8s cached namespace metadata. (15m) Include Kubernetes namespace labels on every record Set an alternative Parser to process record Tag and extract podname, namespacename, containername and dockerid. The parser must be registered in a parsers file (refer to parser filter-kube-test as an example). Debug level between 0 (nothing) and 4 (every

Default: -1 When enabled, turns on certificate validation when connecting to the Kubernetes API server. Default: On When enabled, the filter reads logs coming in Journald format. Default: Off This is an optional feature flag to get metadata information from kubelet instead of calling Kube Server API to enhance the log. Default: Off FilterAws The AWS Filter Enriches logs with AWS Metadata. The availability zone (default:true). Default: true The account ID for current EC2 instance. (default:false) Default: false The EC2 instance image id. (default:false) Default: false The EC2 instance ID. (default:true) Default: true The EC2 instance type. (default:false) Default: false The hostname for current EC2 instance. (default:false) Default: false Specify which version of the instance metadata service to use. Valid values are 'v1' or 'v2' (default). Default: v2 Match filtered records (default:*) Default: * The EC2 instance private ip. (default:false) Default: false The VPC ID for current EC2 instance. (default:false) Default: false FilterModify The Modify Filter plugin allows you to change records using rules and conditions. FluentbitAgent Filter Modification Condition FluentbitAgent Filter Modification Rule FilterModifyRule The Modify Filter plugin allows you to change records using rules and conditions. Add a key/value pair with key KEY and value VALUE if KEY does not exist Copy a key/value pair with key KEY to COPIEDKEY if KEY exists AND COPIEDKEY does not exist Copy a key/value pair with key KEY to COPIEDKEY if KEY exists. If COPIEDKEY already exists, this field is overwritten Rename a key/value pair with key KEY to RENAMEDKEY if KEY exists. If RENAMEDKEY already exists, this field is overwritten Remove a key/value pair with key KEY if it exists Remove all key/value pairs with key matching regexp KEY Remove all key/value pairs with key matching wildcard KEY Rename a key/value pair with key KEY to RENAMEDKEY if KEY exists AND RENAMEDKEY does not exist Add a key/value pair with key KEY and value VALUE. If KEY already exists, this field is overwritten FilterModifyCondition The Modify Filter plugin allows you to change records using rules and conditions. Is true if a key matches regex KEY Is true if KEY does not exist Is true if KEY exists Is true if KEY exists and its value is not VALUE Is true if key KEY exists and its value does not match VALUE Is true if KEY exists and its value is VALUE Is true if key KEY exists and its value matches VALUE Is true if all keys matching KEY have values that do not match VALUE Is true if all keys matching KEY have values that match VALUE Is true if no key matches regex KEY Operation Doc stub VolumeMount defines source and destination folders of a hostPath type pod mount Destination Folder Mount Mode Source folder ForwardOptions defines custom forward output plugin options, see https://docs.fluentbit.io/manual/pipeline/outputs/forward `storage.totallimitsize` Limit the maximum number of Chunks in the filesystem for the current output logical destination. Available in Logging operator version 4.4 and later. Enables dedicated thread(s) for this output. Default value (2) is set since version 1.8.13. For previous versions is 0.