Lightning Talk: Parsing CRI JSON logs with Fluent Bit
Lightningat FluentCon: Cloud Native Logging Day with Fluent Bit and Fluentd Europe 2021 · on Tuesday, 2021-05-04·
summary
Kubernetes moves from dockerd to containerd/CRI-O change how container logs are written: CRI lines include a timestamp, stream, log tag and the original JSON payload so the default docker parser leaves JSON nested in a string and breaks downstream. Fix is twofold: switch the Fluent Bit input to the cri parser (regex extracts time, stream, log tag, and log value) and adjust merge_logs/lifting behavior; examples and configs live at aka.ms/fb_cri, and applying them restores proper JSON parsing and downstream fields.
AI-written summary · about
chapters (3)
related talks
34mGetting Started With Logging in Kubernetes
05mLightning Talk: Flexible Logging Pipelines with Fluentd and Kubernetes
22mLogging: Fluentd & Fluent Bit
26mKubernetes and Logging: Do It Right
05mLightning Talk: What I Wish I’d Known about Fluentd with Kubernetes - Bryan Boreham, Weaveworks
21mWhy Do My Logs Suck?! A Practical Guide to Improving Your Logs
40mLive, Laugh, Log
27mUnder the Hood with Fluent Bit Operator: Kubernetes-native Log Processor