Enhance add_kubernetes_metadata matcher #28868
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -78,59 +78,79 @@ func newLogsPathMatcher(cfg common.Config) (add_kubernetes_metadata.Matcher, err | |
| // Docker container ID is a 64-character-long hexadecimal string | ||
| const containerIdLen = 64 | ||
|
|
||
| func (f *LogPathMatcher) MetadataIndex(event common.MapStr) string { | ||
| value, err := event.GetValue("log.file.path") | ||
| if err != nil { | ||
| f.logger.Errorf("Error extracting log.file.path from the event") | ||
| return "" | ||
| } | ||
|
|
||
| source := value.(string) | ||
| f.logger.Debugf("Incoming log.file.path value: %s", source) | ||
|
|
||
| if !strings.Contains(source, f.LogsPath) { | ||
| f.logger.Errorf("Error extracting container id - source value does not contain matcher's logs_path '%s'.", f.LogsPath) | ||
| return "" | ||
| } | ||
|
|
||
| sourceLen := len(source) | ||
| logsPathLen := len(f.LogsPath) | ||
|
|
||
| if f.ResourceType == "pod" { | ||
| // Pod resource type will extract only the pod UID, which offers less granularity of metadata when compared to the container ID | ||
| if strings.HasSuffix(source, ".log") { | ||
| // Specify a pod resource type when writting logs into manually mounted log volume, | ||
| // those logs apper under under "/var/lib/kubelet/pods/<pod_id>/volumes/..." | ||
| if strings.HasPrefix(f.LogsPath, podKubeletLogsPath()) { | ||
| pathDirs := strings.Split(source, pathSeparator) | ||
| podUIDPos := 5 | ||
| if len(pathDirs) > podUIDPos { | ||
| podUID := strings.Split(source, pathSeparator)[podUIDPos] | ||
| f.logger.Debugf("Using pod uid: %s", podUID) | ||
| return podUID | ||
| } | ||
| } | ||
| // In case of the Kubernetes log path "/var/log/pods/", | ||
| // the pod ID will be extracted from the directory name, | ||
| // file name example: "/var/log/pods/'<namespace>_<pod_name>_<pod_uid>'/container_name/0.log". | ||
| if strings.HasPrefix(f.LogsPath, podLogsPath()) { | ||
| pathDirs := strings.Split(source, pathSeparator) | ||
| podUIDPos := 4 | ||
| if len(pathDirs) > podUIDPos { | ||
| podUID := strings.Split(pathDirs[podUIDPos], "_") | ||
| if len(podUID) > 2 { | ||
| f.logger.Debugf("Using pod uid: %s", podUID) | ||
|
There was a problem hiding this comment. Maybe log the podUID[2] here instead of the array There was a problem hiding this comment. thank you for pointing it out! fixed: e8ab1fe |
||
| return podUID[2] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| f.logger.Error(`Error extracting pod uid - source value does not contains matcher's logs_path, | ||
|
There was a problem hiding this comment. Wondering if we should prevent this from happening by validating the configuration. wdyt? There was a problem hiding this comment. could you please elaborate on this? do you mean do smth similar to other processors. like - https://github.com/elastic/beats/blob/master/libbeat/processors/add_kubernetes_metadata/config.go ? There was a problem hiding this comment. Yes, in we can check ifmatchers' config is valid too so as to warn the users early on and avoid initialising the processor in case the config is not supported. I see that the matcher's config part is a map so not sure how much mangling this change would require but it should be doable. Let me know what you think.
There was a problem hiding this comment. I will give it a try |
||
| supported log_path for 'pod' resource_type: '/var/lib/kubelet/pods/', '/var/log/pods/'.`) | ||
| return "" | ||
| } | ||
| } | ||
| // In case of the Kubernetes log path "/var/log/containers/", | ||
| // the container ID will be located right before the ".log" extension. | ||
| // file name example: /var/log/containers/<pod_name>_<namespace>_<container_name>-<continer_id>.log | ||
| if strings.HasPrefix(f.LogsPath, containerLogsPath()) && strings.HasSuffix(source, ".log") && sourceLen >= containerIdLen+4 { | ||
| containerIDEnd := sourceLen - 4 | ||
| cid := source[containerIDEnd-containerIdLen : containerIDEnd] | ||
| f.logger.Debugf("Using container id: %s", cid) | ||
| return cid | ||
| } | ||
|
|
||
| // In any other case, we assume the container ID will follow right after the log path. | ||
| // However we need to check the length to prevent "slice bound out of range" runtime errors. | ||
| // for the default log path /var/lib/docker/containers/ container ID will follow right after the log path. | ||
| // file name example: /var/lib/docker/containers/<container_id>/<container_id>-json.log | ||
| if sourceLen >= logsPathLen+containerIdLen { | ||
| cid := source[logsPathLen : logsPathLen+containerIdLen] | ||
| f.logger.Debugf("Using container id: %s", cid) | ||
| return cid | ||
| } | ||
|
|
||
| f.logger.Error("Error extracting container id - source value contains matcher's logs_path, however it is too short to contain a Docker container ID.") | ||
| return "" | ||
| } | ||
|
|
||
|
|
@@ -141,13 +161,20 @@ func defaultLogPath() string { | |
| return "/var/lib/docker/containers/" | ||
| } | ||
|
|
||
| func podKubeletLogsPath() string { | ||
| if runtime.GOOS == "windows" { | ||
| return "C:\\var\\lib\\kubelet\\pods\\" | ||
| } | ||
| return "/var/lib/kubelet/pods/" | ||
| } | ||
|
|
||
| func podLogsPath() string { | ||
| if runtime.GOOS == "windows" { | ||
| return "C:\\var\\log\\pods\\" | ||
| } | ||
| return "/var/log/pods/" | ||
| } | ||
|
|
||
| func containerLogsPath() string { | ||
| if runtime.GOOS == "windows" { | ||
| return "C:\\var\\log\\containers\\" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We may still need to log
sourcehere so as to have a more clear view of how the event that is related to this error looks like.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do you mean
eventinstead ofsource? this error might only occur in caseeventmap does not containlog.file.path(=source) keyThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeap my wrong,
eventis what I was thinking about. Logging the wholeeventwould be helpful.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also maybe just a debug message would be enough, since ERRORs would flood a basic case when the processor for some reason does not work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fixed: e8ab1fe