fluent-bit丢弃指定字段

作者: root007 分类: Linux 发布时间: 2021-08-06 18:42

一、

{“@timestamp”:1628246104.531301,”cpu_p”:3.625,”user_p”:2.625,”system_p”:1.0,”cpu0.p_cpu”:2.0,”cpu0.p_user”:2.0,”cpu0.p_system”:0.0,”cpu1.p_cpu”:1.0,”cpu1.p_user”:1.0,”cpu1.p_system”:0.0,”cpu2.p_cpu”:2.0,”cpu2.p_user”:1.0,”cpu2.p_system”:1.0,”cpu3.p_cpu”:3.0,”cpu3.p_user”:2.0,”cpu3.p_system”:1.0,”cpu4.p_cpu”:8.0,”cpu4.p_user”:6.0,”cpu4.p_system”:2.0,”cpu5.p_cpu”:2.0,”cpu5.p_user”:1.0,”cpu5.p_system”:1.0,”cpu6.p_cpu”:8.0,”cpu6.p_user”:6.0,”cpu6.p_system”:2.0,”cpu7.p_cpu”:2.0,”cpu7.p_user”:1.0,”cpu7.p_system”:1.0}

docker run -ti fluent/fluent-bit:1.8 /fluent-bit/bin/fluent-bit -i cpu -F modify -p 'Remove_wildcard=cpu7' -m '*'  -o kafka -p brokers=172.16.29.184:9092 -p topics=test 
 Remove dummy_field    #指定字段
Remove_wildcard ignore_field #前缀匹配
[FILTER]
    Name  modify
    Match *

    Copy  message original_message
    Set   message Hello!!
    Add   filter_type modify
    Add   hostname ${HOSTNAME}
    Remove dummy_field
    Remove_wildcard cpu7

二、只收集对应labelpod的日志

  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off
        Annotations         Off
    [FILTER]
        Name           grep
        Match          kube.*
        regex         $kubernetes['labels']['logging'] true#只收集logging=true的label日志

发表评论

邮箱地址不会被公开。 必填项已用*标注