From bb1c50b2d77fea6118c2c55894e7b4144dce8c32 Mon Sep 17 00:00:00 2001
From: Alexandre Allard <alexandre.allard@scality.com>
Date: Mon, 8 Mar 2021 15:56:16 +0100
Subject: [PATCH] salt: Improve fluent-bit parser

Remove the date from the logs once parsed by
fluent-bit as we do not need it anymore and
it allows to improve the logs readability.
Plus, it is also need by the alert history
feature, this way we only end up with a JSON
formatted alert in logs which makes it easier
to parse/use by other components.

Refs: #3180
(cherry picked from commit 73f46cf1e28d0d1e31098a36b49e31acdfadc09b)
---
 .../logging/fluent-bit/deployed/configmap.sls      | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls b/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls
index ab64bbe076..ec3ba907d7 100644
--- a/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls
+++ b/salt/metalk8s/addons/logging/fluent-bit/deployed/configmap.sls
@@ -39,7 +39,7 @@ Create fluent-bit ConfigMap:
                 Name           tail
                 Tag            kube.*
                 Path           /var/log/containers/*.log
-                Parser         docker
+                Parser         container
                 DB             /run/fluent-bit/flb_kube.db
                 Mem_Buf_Limit  5MB
             [INPUT]
@@ -76,6 +76,10 @@ Create fluent-bit ConfigMap:
                 Remove         BOOT_ID
                 Remove         UID
                 Remove         GID
+            [FILTER]
+                Name           modify
+                Match          kube.*
+                Remove         logtag
 {%- for index in range(loki.spec.deployment.replicas) %}
             [Output]
                 Name           loki
@@ -109,7 +113,9 @@ Create fluent-bit ConfigMap:
             }
           parsers.conf: |-
             [PARSER]
-                Name        docker
-                Format      json
+                Name        container
+                Format      regex
+                Regex       ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]+) (?<message>.+)$
                 Time_Key    time
-                Time_Format %Y-%m-%dT%H:%M:%S.%L
+                Time_Format %Y-%m-%dT%H:%M:%S.%L%z
+                Time_Keep   Off