Hello everyone,
I’m experiencing an issue with the cri plugin. My original configuration is as follows:
<source>
@type tail
path /var/log/containers/*.log
pos_file /var/log/fluentd-es-containers.log.pos
tag kubernetes.*
read_from_head true
<parse>
@type multi_format
<pattern>
format cri
time_format %Y-%m-%dT%H:%M:%S.%N%Z
<parse>
@type json
</parse>
<parse>
@type none
</parse>
</pattern>
<pattern>
format none
</pattern>
</parse>
</source>
My expectation was that logs containing JSON would be parsed accordingly, and all Java logs would be handled by the none parser. However, I noticed that the logs are still being processed using the cri format instead of matching the expected pattern.
For example, here is a log entry after applying this configuration:
2025-03-15T15:35:09.417781166+03:30 stdout F at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
Could anyone help me understand why the logs aren’t matching the cri pattern as intended?
Thank you.
Hello everyone,
I’m experiencing an issue with the
criplugin. My original configuration is as follows:My expectation was that logs containing JSON would be parsed accordingly, and all Java logs would be handled by the none parser. However, I noticed that the logs are still being processed using the
criformat instead of matching the expected pattern.For example, here is a log entry after applying this configuration:
Could anyone help me understand why the logs aren’t matching the
cripattern as intended?Thank you.