Merge pull request #26 from noosenergy/hotfix/intail-containers-source

Hotfix/intail-containers-source

docker/exporter/Dockerfile

@@ -20,7 +20,7 @@ RUN apt-get update \
     && gem install \
         fluent-plugin-kubernetes_metadata_filter \
         fluent-plugin-multi-format-parser \
-        fluent-plugin-rewrite-tag-filter \
+        fluent-plugin-concat \
         fluent-plugin-loggly \
         fluent-plugin-slack \
     && gem sources --clear-all \

helm/chart/files/kubernetes.conf

@@ -2,34 +2,43 @@
 <source>
   @type tail
   @id in_tail_container_logs
-  @label @KUBERNETES_LOG
+  @label @CONTAINERD_LOG
   path /var/log/containers/*.log
   pos_file /var/log/fluentd-containers.log.pos
   # https://docs.fluentd.org/input/tail#read_from_head
   read_from_head true
   skip_refresh_on_startup true
   # Tag required by default
   tag kubernetes.*
+  # For Containerd CRI (for EKS >= v1.24)
   <parse>
-    @type multi_format
-    # For docker CRI (for EKS < v1.24)
-    <pattern>
-      format json
-      time_key time
-      time_type string
-      time_format "%Y-%m-%dT%H:%M:%S.%NZ"
-      keep_time_key true
-    </pattern>
-    # For containerd CRI (for EKS >= v1.24)
-    <pattern>
-      # format /^(?<time>.+) (?<stream>stdout|stderr) [^ ]* (?<log>.*)$/
-      format /^(?<time>.+) (?<stream>stdout|stderr) (?<logtag>[FP]) (?<log>.*)$/
-      time_format "%Y-%m-%dT%H:%M:%S.%N%:z"
-      keep_time_key true
-    </pattern>
+    @type regexp
+    expression /^(?<time>.+) (?<stream>stdout|stderr) (?<logtag>[FP]) (?<log>.*)$/
+    time_key time
+    time_type string
+    time_format "%Y-%m-%dT%H:%M:%S.%N%:z"
+    keep_time_key false
   </parse>
 </source>
 
+<label @CONTAINERD_LOG>
+  # Concatenate multiline logs
+  # https://github.com/fluent-plugins-nursery/fluent-plugin-concat
+  <filter **>
+    @type concat
+    @id filter_multiline_log
+    key log
+    use_first_timestamp true
+    partial_key logtag
+    partial_value P
+    separator ""
+  </filter>
+  <match **>
+    @type relabel
+    @label @KUBERNETES_LOG
+  </match>
+</label>
+
 <label @KUBERNETES_LOG>
   # Add kubernetes metadata
   # https://github.com/fabric8io/fluent-plugin-kubernetes_metadata_filter