How to match logs from specific containers? about fluent-plugin-kubernetes_metadata_filter HOT 4 CLOSED

Thanks a lot! I found the tag for the spammy container to follow the pattern kubernetes.var.log.containers.my-spammy-container**, so I'm matching that now :)

Closing the issue!

from fluent-plugin-kubernetes_metadata_filter.

your match statement would be done using wildcard expansion.
If "my_super_spammy_deployment" was a namespace it would be something like:

<match **_spammynamespace_**>
  @type null
</match>

** will match anything (including delimiters)
* will not include delimiters

Hope that helps

from fluent-plugin-kubernetes_metadata_filter.

Will that match any key, though? That could lead to false positives (eg: a log line like The user 'my user name is spammynamespace' has logged in to my awesome service would match). I know exactly which field I would like to match against, can't I specify that somehow?

from fluent-plugin-kubernetes_metadata_filter.

That match is only performed on the record's tag [1] not the contents of the log message itself. The tag is based on the kubernetes pod information that includes the namespace, pod name, and container id.

[1] https://docs.fluentd.org/v0.12/articles/config-file#2-ldquomatchrdquo-tell-fluentd-what-to-do

from fluent-plugin-kubernetes_metadata_filter.