Adding native otel logs collection for windows nodes

CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Added
 
 - Auto collect metrics for the apiserver control plane component
+- Add native OTel logs collection for the Windows node (#361)
 
 ### Fixed
 

examples/README.md

@@ -35,13 +35,12 @@ This configuration will install application for windows worker node only.
 
 All windows images are available in a separate `quay.io` repository: `quay.io/signalfx/splunk-otel-collector-windows`.
 
-Windows support covers traces and metrics collection only, no logs will be collected. As of now, we don’t have fluentd-hec image for the windows worker node.
+Logs collection on Windows is only available using OTel native logs collection. Fluentd log engine is not supported.
 
 ```yaml
 image:
   otelcol:
     repository: quay.io/signalfx/splunk-otel-collector-windows
-logsEnabled: false
 readinessProbe:
   initialDelaySeconds: 60
 livenessProbe:

helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl

@@ -130,13 +130,21 @@ receivers:
 
   {{- if and (eq .Values.logsEngine "otel") .Values.logsCollection.containers.enabled }}
   filelog:
+    {{- if .Values.isWindows }}
+    include: ["C:\\var\\log\\pods\\*\\*\\*.log"]
+    {{- else }}
     include: ["/var/log/pods/*/*/*.log"]
+    {{- end }}
     # Exclude logs. The file format is
     # /var/log/pods/<namespace_name>_<pod_name>_<pod_uid>/<container_name>/<restart_count>.log
     exclude:
       {{- if .Values.logsCollection.containers.excludeAgentLogs }}
+      {{- if .Values.isWindows }}
+      - "C:\\var\\log\\pods\\{{ .Release.Namespace }}_{{ include "splunk-otel-collector.fullname" . }}*_*\\otel-collector\\*.log"
+      {{- else }}
       - /var/log/pods/{{ .Release.Namespace }}_{{ include "splunk-otel-collector.fullname" . }}*_*/otel-collector/*.log
       {{- end }}
+      {{- end }}
       {{- range $_, $excludePath := .Values.logsCollection.containers.excludePaths }}
       - {{ $excludePath }}
       {{- end }}
@@ -221,7 +229,11 @@ receivers:
       # Extract metadata from file path
       - type: regex_parser
         id: extract_metadata_from_filepath
+        {{- if .Values.isWindows }}
+        regex: '^C:\\var\\log\\pods\\(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[^\/]+)\\(?P<container_name>[^\._]+)\\(?P<restart_count>\d+)\.log$'
+        {{- else }}
         regex: '^\/var\/log\/pods\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[^\/]+)\/(?P<container_name>[^\._]+)\/(?P<restart_count>\d+)\.log$'
+        {{- end }}
         parse_from: $$attributes["file.path"]
       # Move out attributes to Attributes
       - type: metadata

helm-charts/splunk-otel-collector/templates/daemonset.yaml

@@ -61,7 +61,7 @@ spec:
       tolerations:
         {{ toYaml . | nindent 8 }}
       {{- end }}
-      {{- if (eq (include "splunk-otel-collector.logsEnabled" .) "true") }}
+      {{- if and (eq (include "splunk-otel-collector.logsEnabled" .) "true") (not .Values.isWindows) }}
       initContainers:
         {{- if (eq .Values.logsEngine "fluentd") }}
         - name: prepare-fluentd-config
@@ -349,12 +349,22 @@ spec:
           readOnly: true
         {{- end }}
         {{- if and (eq (include "splunk-otel-collector.logsEnabled" $) "true") (eq .Values.logsEngine "otel") }}
+        {{- if .Values.isWindows }}
+        - name: varlog
+          mountPath: C:\var\log
+          readOnly: true
+          # C:\ProgramData mount is needed for access to container storage in C:\ProgramData\docker\containers and C:\ProgramData\containerd\root.
+        - name: programdata
+          mountPath: C:\ProgramData
+          readOnly: true
+        {{- else }}
         - name: varlog
           mountPath: /var/log
           readOnly: true
         - name: varlibdockercontainers
           mountPath: /var/lib/docker/containers
           readOnly: true
+        {{- end }}
         - name: checkpoint
           mountPath: {{ .Values.logsCollection.checkpointPath }}
         {{- end }}
@@ -387,12 +397,21 @@ spec:
           name: {{ template "splunk-otel-collector.fullname" . }}-fluentd-json
       {{- end}}
       {{- if eq .Values.logsEngine "otel" }}
+      {{- if .Values.isWindows }}
+      - name: varlog
+        hostPath:
+          path: C:\var\log
+      - name: programdata
+        hostPath:
+          path: C:\ProgramData
+      {{- else }}
       - name: varlog
         hostPath:
           path: /var/log
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/containers
+      {{- end }}
       - name: checkpoint
         hostPath:
           path: {{ .Values.logsCollection.checkpointPath }}