how to parse kubelet log with fluentd

Question

The origal kubelet log is such like this:

I0605 09:03:41.463195   28799 setters.go:72] Using node IP: "10.127.7.174"

I can parse it in fluentd as:

format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/

However, kubespary deploy kubelet as following: 1. journald collects kubelet log; 2. I write a rsyslog file, so kubelet log can be stored in /var/log/kubelet.log. And the log changes to:

Jun  5 09:03:41 k8s-4 kubelet: I0605 09:03:41.463195   28799 setters.go:72] Using node IP: "10.127.7.174"

I wonder how to parse this.

Answer 1

I've tried to parse your log example file and use the following regexp filter to achieve the result:

format /(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/

This will split keys accordingly as per Fluentular output:

time 2019/06/06 08:19:35 +0000

host k8s-4

ident kubelet

message I0605 09:03:41.463195 28799 setters.go:72] Using node IP: "10.127.7.174"

In order to get more stuff to learn about Fluentd regexp just read documentation.

FYI. There is also opportunity to capture logs from systemd via fluent-plugin-systemd as well.