Kubernetes Inputs

Overview

This input type allows you to specify Kubernetes pods and namespaces for Edge Delta to monitor.

Review Sample Configuration 

Review the following sample configuration: 

  kubernetes:
    - labels: "nginx,errorcheck"
      include:
        - "pod=^nginx.*$,kind=ReplicaSet,namespace=default,container-name=nginx,container-image=docker.io/nginx:latest,labels.my_app=abc"
      exclude: # exclude has higher priority
        - "namespace=^kube-system$"
    - labels: "apache,errorcheck"
      include:
        - "pod=^apache.*$,namespace=.*web*"
      exclude: # exclude has higher priority
        - "namespace=^kube-nginx$"
        - "pod=.*nginx*,kind=StatefulSet"
    - labels: "k8s with enrichment dynamic fields from labels"
      include:
        - "pod=flog,namespace=default"
      filters:
      - enrichment-failure-behavior
    - labels: "k8s with enrichment aws metadata"
      include:
        - "pod=flog,namespace=default"
      filters:
      - enrichment-aws

Review Parameters

Review the following parameters that you can configure in the Edge Delta App.

labels

Required

Enter a descriptive label for this input. 

When you create a workflow, you will use this label to enter your input into the workflow. 

apache,errorcheck is the default label.

Review the following example: 

labels: "apache,errorcheck"

exclude

Optional 

Enter the Kubernetes attributes to exclude.

To specify which input to add, you must provide include/exclude regex filters.

• All rules in the same line with a comma(",") separated means AND:

   exclude:
     - "rule-1,rule-2"
  

• All rules under the same part (include/exclude) means OR:

   exclude:
     - "rule-1"
     - "rule-2"
  

• The Kubernetes Exclude field takes precedence over the Kubernetes Include field.
• If the value you provide after pod=, namespace=, or kind= is contained anywhere in the pod or namespace name, then the value will match.

Review the following example: 

exclude: 
  - "namespace=^kube-nginx$"
  - "pod=.*nginx*,kind=StatefulSet"

auto_detect_line_pattern

Optional 

Enter true or false to enable auto line detection for log messages with multiple lines.

Review the following example: 

auto_detect_line_pattern: true

boost_stracktrace_detection

Optional

Enter true or false to enhance (or troubleshoot missed patterns) the Auto Line Detection parameter. 

Review the following example: 

boost_stacktrace_detection: true

filters 

Optional

Enter an existing filter to add to this input. 

Note

In addition to the Kubernetes-specific filters that you can configure, you can also use universal filters, such as regex, that are applicable to most inputs.

You can use a filter to discard unnecessary logs or protect sensitive data. As a result, filters can help reduce the agent's resource load because of the reduced log ingestion.

To use a universal filter, you must: 

1. Create a filter
2. Add the filter to the input
3. Review the following example of how to add the regex-error-doc-example filter into a YAML file:

   filters:
   - name: regex-error-doc-example
     type: regex
     pattern: error|ERROR|ERR|Err

To learn more about universal filters, see Filters.

Review the following example: 

filters: 
  - info 
  - not_trace 
  - mask_card 
  - mask_password