# journal entries from k8s containers look like this:
# The stream identification is encoded into the PRIORITY field as an
# integer: 6, or github.com/coreos/go-systemd/journal.Info, marks stdout,
# while 3, or github.com/coreos/go-systemd/journal.Err, marks stderr.
# PRIORITY=6
# CONTAINER_ID=b6cbb6e73c0a
# CONTAINER_ID_FULL=b6cbb6e73c0ad63ab820e4baa97cdc77cec729930e38a714826764ac0491341a
# CONTAINER_NAME=k8s_registry.a49f5318_docker-registry-1-hhoj0_default_ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a_799e4035
# MESSAGE=172.17.0.1 - - [21/May/2016:16:52:05 +0000] "GET /healthz HTTP/1.1" 200 0 "" "Go-http-client/1.1"
# or
# MESSAGE=time="2016-05-21T15:14:17.216966675Z" level=info msg="version=v2.1.0+unknown"
# docker inspect:
# "io.kubernetes.container.hash": "a49f5318",
# "io.kubernetes.container.name": "registry",
# "io.kubernetes.pod.name": "docker-registry-1-hhoj0",
# "io.kubernetes.pod.namespace": "default",
# "io.kubernetes.pod.terminationGracePeriod": "30",
# "io.kubernetes.pod.uid": "ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a",
# docker ps:
# da531d7cea12 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e   "sh /opt/app-root/src"   About an hour ago   Up About an hour
# k8s_elasticsearch.8d3af8fd_logging-es-ops-gkfv06wi-1-7y682_logging_9612f891-1f68-11e6-80a2-fa163e2fff3a_d1cc32e1
# oc get pods -o yaml:
#      kubernetes.io/created-by: |
# {"name":"logging-es-ops-gkfv06wi-1","uid":"92d90581-1f68-11e6-80a2-fa163e2fff3a","apiVersion":"v1","resourceVersion":"829"}}
# openshift.io/deployment-config.name: logging-es-ops-gkfv06wi
# openshift.io/deployment.name: logging-es-ops-gkfv06wi-1
# uid: 9612f891-1f68-11e6-80a2-fa163e2fff3a
# image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
# containerStatuses:
#  - containerID: docker://da531d7cea12bf714f90c26d0fb9f275b02321d1bccd10013f087be33f4e6e5e
#    image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
#    imageID: docker://sha256:d5a02bf63b1f3e0d1aa06bf28928e181f67ab2c80b2a1d1fd1ba310f11c12955
# another example:
# CONTAINER_NAME=k8s_bob.94e110c7_bob-iq0d4_default_2d67916a-1eac-11e6-94ba-001c42e13e5d_8b4b7e3d
# From this, we can extract:
#    container name in pod: bob
#    pod name: bob-iq0d4
#    namespace: default
#    pod uid: 2d67916a-1eac-11e6-94ba-001c42e13e5d

# in addition, there are a few other differences about /var/log/messages and journal messages
# * the default rsyslog.conf on el7 will only log messages to /var/log/messages at INFO level
#   or higher
# * the default rsyslog.d includes 21-cloudinit.conf which redirects all cloud-init messages
#   to /var/log/cloud-init.log
#   When using the journal, we keep the cloud-init messages and store
#   them in elasticsearch.  But we filter out DEBUG messages.
#   We should revisit this at a later date, when we have a good grasp of the storage
#   requirements, so we can turn on this firehose.

@include filter-exclude-journal-debug.conf

<match journal>
  @type rewrite_tag_filter
  # skip to @INGRESS label section
  @label @INGRESS
  # see if this is a kibana container for special log handling
  # looks like this:
  # k8s_kibana.a67f366_logging-kibana-1-d90e3_logging_26c51a61-2835-11e6-ad29-fa163e4944d5_f0db49a2
  # we filter these logs through the kibana_transform.conf filter
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_kibana\.
    tag kubernetes.journal.container.kibana
  </rule>
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_[^_]+_logging-eventrouter-[^_]+_
    tag kubernetes.journal.container._default_.kubernetes-event
  </rule>
  # mark logs from default namespace for processing as k8s logs but stored as system logs
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_[^_]+_[^_]+_default_
    tag kubernetes.journal.container._default_
  </rule>
  # mark logs from kube-* namespaces for processing as k8s logs but stored as system logs
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_[^_]+_[^_]+_kube-(.+)_
    tag kubernetes.journal.container._kube-$1_
  </rule>
  # mark logs from openshift-* namespaces for processing as k8s logs but stored as system logs
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_[^_]+_[^_]+_openshift-(.+)_
    tag kubernetes.journal.container._openshift-$1_
  </rule>
  # mark logs from openshift namespace for processing as k8s logs but stored as system logs
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_[^_]+_[^_]+_openshift_
    tag kubernetes.journal.container._openshift_
  </rule>
  # mark fluentd container logs
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_.*fluentd
    tag kubernetes.journal.container.fluentd
  </rule>
  # this is a kubernetes container
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_
    tag kubernetes.journal.container
  </rule>
  # not kubernetes - assume a system log or system container log
  <rule>
    key _TRANSPORT
    pattern .+
    tag journal.system
  </rule>
</match>
