fluent-operator icon indicating copy to clipboard operation
fluent-operator copied to clipboard

help request: how to deal with "rewriteTag" and multiple matches?

Open benediktwetzel opened this issue 2 years ago • 1 comments

Describe the issue

Hi, first of all thank you for your great work on this operator!

I would like to migrate our fluent-bit configuration to the fluent operator. We collect logs from Kubernetes after we rewrite the tag of records according to an annotation in Kubernetes. After that, we match for this new tag in the next filters.

Short example:

[FILTER]
    Name   rewrite_tag
    Match  kube.*
    Rule   $kubernetes['annotations']['example'] ^([A-Za-z0-9\-]+)$ newTag-$1 false

[FILTER]
    Name   grep
    Match newTag-example-a
    Regex  ""

[FILTER]
    Name   grep
    Match  newTag-example-b
    Regex ""

How can we do this with the ClusterFilter CR? I haven't found a way to set multiple matches, and if we use multiple ClusterFilter resources, I'm not sure what the order of the defined filters is?

How did you install fluent operator?

Helm

Additional context

No response

benediktwetzel avatar Sep 20 '23 17:09 benediktwetzel