Change:
Alias            kube_containers Tag              kube_<namespace_name>_<pod_name>_<container_name> Tag_Regex        (?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)- <del> Path             /var/log/containers/*.log </del> Mem_Buf_Limit    5MB Skip_Long_Lines  On Refresh_Interval 5 <del> DB               flb_kube.db # Settings from fluentd missing here. # tag reform.* # format json # time_key time # time_format %Y-%m-%dT%H:%M:%S.%NZ </del> <ins> Path             C:varlogcontainers*.log DB               /var/run/google-fluentbit/pos-files/flb_kube.db [FILTER] Name         parser Match        kube_* Key_Name     log Reserve_Data True Parser       docker Parser       containerd </ins> # Example: <del> # I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537] </del> <ins> # I0928 03:15:50.440223    4880 main.go:51] Starting CSI-Proxy Server ... </ins> [INPUT] Name             tail <del> Alias            kubelet Tag              kubelet #Multiline        on #Multiline_Flush  5 </del> <ins> Alias            csi-proxy Tag              csi-proxy </ins> Mem_Buf_Limit    5MB Skip_Long_Lines  On Refresh_Interval 5 <del> Path /etc/kubernetes/logs/kubelet.log DB               /etc/kubernetes/logs/gcp-kubelet.db # Copied from fluentbit config. How is this used ? In match stages ? Parser_Firstline /^wd{4}/ Parser_1         ^(?<severity>w)(?<time>d{4} [^s]*)s+(?<pid>d+)s+(?<source>[^ ]]+)] (?<message>.*)/ # missing from fluentbit #   time_format %m%d %H:%M:%S.%N </del> <ins> Path             /etc/kubernetes/logs/csi-proxy.log DB               /var/run/google-fluentbit/pos-files/csi-proxy.db Multiline        On Parser_Firstline glog </ins> <del> # Example: # I0928 03:15:50.440223    4880 main.go:51] Starting CSI-Proxy Server ... </del> <ins> # I1118 21:26:53.975789       6 proxier.go:1096] Port "nodePort for kube-system/default-http-backend:http" (:31429/tcp) was open before and is still needed </ins> [INPUT] Name             tail <del> Alias            csi-proxy Tag              csi-proxy #Multiline        on #Multiline_Flush  5 </del> <ins> Alias            kube-proxy Tag              kube-proxy </ins> Mem_Buf_Limit    5MB Skip_Long_Lines  On Refresh_Interval 5 <del> Path             /etc/kubernetes/logs/csi-proxy.log DB               /etc/kubernetes/logs/gcp-csi-proxy.db # Copied from fluentbit config. How is this used ? In match stages ? Parser_Firstline /^wd{4}/ Parser_1         ^(?<severity>w)(?<time>d{4} [^s]*)s+(?<pid>d+)s+(?<source>[^ ]]+)] (?<message>.*)/ # missing from fluentbit #   time_format %m%d %H:%M:%S.%N </del> <ins> Path             /etc/kubernetes/logs/kube-proxy.log DB               /var/run/google-fluentbit/pos-files/kube-proxy.db Multiline        On Parser_Firstline glog </ins> # Example: # time="2019-12-10T21:27:59.836946700Z" level=info msg="loading plugin "io.containerd.grpc.v1.cri"..." type=io.containerd.grpc.v1 [INPUT] Name             tail Alias            container-runtime <del> Tag container-runtime #Multiline        on #Multiline_Flush  5 </del> <ins> Tag              container-runtime </ins> Mem_Buf_Limit    5MB Skip_Long_Lines  On Refresh_Interval 5 Path             /etc/kubernetes/logs/containerd.log <del> DB               /etc/kubernetes/logs/gcp-containerd.log.pos # Copied from fluentbit config. How is this used ? In match stages ? Parser_Firstline /^wd{4}/ Parser_1         ^(?<severity>w)(?<time>d{4} [^s]*)s+(?<pid>d+)s+(?<source>[^ ]]+)] (?<message>.*)/ </del> <ins> DB               /var/run/google-fluentbit/pos-files/container-runtime.db # TODO: Add custom parser for containerd logs once format is settled. </ins> <del> # missing from fluentbit #   time_format %m%d %H:%M:%S.%N # I1118 21:26:53.975789       6 proxier.go:1096] Port "nodePort for kube-system/default-http-backend:http" (:31429/tcp) was open before and is still needed </del> <ins> # Example: # I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537] </ins> [INPUT] Name             tail <del> Alias            kube-proxy Tag              kube-proxy #Multiline        on #Multiline_Flush  5 </del> <ins> Alias            kubelet Tag              kubelet </ins> Mem_Buf_Limit    5MB Skip_Long_Lines  On Refresh_Interval 5 <del> Path             /etc/kubernetes/logs/kube-proxy.log DB               /etc/kubernetes/logs/gcp-kubeproxy.db # Copied from fluentbit config. How is this used ? In match stages ? Parser_Firstline /^wd{4}/ Parser_1         ^(?<severity>w)(?<time>d{4} [^s]*)s+(?<pid>d+)s+(?<source>[^ ]]+)] (?<message>.*)/ # missing from fluentbit #   time_format %m%d %H:%M:%S.%N </del> <ins> Path             /etc/kubernetes/logs/kubelet.log DB               /var/run/google-fluentbit/pos-files/kubelet.db Multiline        On Parser_Firstline glog </ins> [FILTER] Name        modify Match       * Hard_rename log message <del> # [OUTPUT] #    Name        http #    Match       * #    Host        127.0.0.1 #    Port        2021 #    URI         /logs #    header_tag  FLUENT-TAG #    Format      msgpack #    Retry_Limit 2 </del> <ins> [FILTER] Name         parser Match        kube_* Key_Name     message Reserve_Data True Parser       glog Parser       json </ins> [OUTPUT] <del> name  stackdriver match * </del> <ins> Name        http Match       * Host        127.0.0.1 Port        2021 URI         /logs header_tag  FLUENT-TAG Format      msgpack Retry_Limit 2 </ins> '@ # Fluentbit parsers config file $PARSERS_CONFIG = @' [PARSER] Name        docker Format      json

Discussion:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --The default fluent-bit configuration for GCE Windows nodes produces unparsed JSON logs and does not forward container logs. Container log output is produced. fluent-bit on a given windows image. a GCE Windows e2e cluster and view the stackdriver output for pods. Kubernetes version (use ): 1.20+ Cloud provider or hardware configuration: GKE/GCE OS (e.g: ): Windows Kernel (e.g. ): Any version Install tools: fluent-bit Network plugin and version (if this is a network-related bug): Others:
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig windows