Class: LogStash::Filters::Kubernetes

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/kubernetes.rb

Overview

This filter plugin allows you extract Pod, Namespace, etc from kubernetes. The way this filter works is very simple. It looks at an event field which contains full path to kubelet created symlinks to docker container logs and extracts useful information from a symlink name. No access to Kubernetes API is required.

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/logstash/filters/kubernetes.rb', line 41

def filter(event)
  if @source and event.get(@source)
    parts = event.get(@source).split(File::SEPARATOR).last.gsub(/.log$/, '').split('_')

    # We do not care about empty POD log files
    if parts.length != 3 || parts[2].start_with?('POD-')
      return
    else
      kubernetes = {}
      kubernetes['replication_controller'] = parts[0].gsub(/-[0-9a-z]*$/, '')
      kubernetes['pod'] = parts[0]
      kubernetes['namespace'] = parts[1]
      kubernetes['container_name'] = parts[2].gsub(/-[0-9a-z]*$/, '')
      kubernetes['container_id'] = parts[2].split('-').last

      event.set(@target, kubernetes)
    end
  end

  filter_matched(event)
end

#register ⇒ Object 



39
 
# File 'lib/logstash/filters/kubernetes.rb', line 39

def register; end