Kubernetes Logging

docker run --rm  \
    fluent/fluent-bit:2.2 \
    -q \
    -i dummy \
    -p 'tag=dummy.data' \
    -p 'samples=3' \
    -p 'dummy={"data":"100 0.5 true This is example"}' \
    -o stdout

[0] dummy.data: [[1709527380.566845126, {}], {"data"=>"100 0.5 true This is example"}]
[0] dummy.data: [[1709527381.561442519, {}], {"data"=>"100 0.5 true This is example"}]
[0] dummy.data: [[1709527382.561138285, {}], {"data"=>"100 0.5 true This is example"}]

[INPUT]
    name              tail
    tag               kube.*
    path              /var/log/containers/*.log
    #exclude_path      /var/log/containers/*_logging_*.log,/var/log/containers/*_default*.log
    multiline.parser  cri,docker
    db                /var/log/flb_kube.db
    mem_buf_limit     5MB
    skip_long_lines   on
    refresh_interval  10

[INPUT]
    name              systemd
    tag               host.*
    db                /var/log/flb_host.db
    systemd_filter    _SYSTEMD_UNIT=docker.service
    systemd_filter    _SYSTEMD_UNIT=containerd.service
    systemd_filter    _SYSTEMD_UNIT=kubelet.service
    strip_underscores on

[FILTER]
    name                kubernetes
    match               kube.*
    kube_url            https://kubernetes.default.svc:443
    kube_ca_file        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    kube_token_file     /var/run/secrets/kubernetes.io/serviceaccount/token
    kube_tag_prefix     kube.var.log.containers.
    annotations         off
    merge_log           on
    #merge_log_key      merge_log
    k8s-logging.parser  off
    k8s-logging.exclude off

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fluentbitds
  namespace: fluentbit-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fluentbit
rules:
  - apiGroups: [""]
    resources:
      - namespaces
      - pods
      # The difference is that kubelet need a special permission
      # for resource `nodes/proxy` to get HTTP request in.
      - nodes
      - nodes/proxy
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fluentbit
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: fluentbit
subjects:
  - kind: ServiceAccount
    name: fluentbitds
    namespace: fluentbit-system

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentbit
  namespace: fluentbit-system
  labels:
    app.kubernetes.io/name: fluentbit
spec:
  selector:
    matchLabels:
      name: fluentbit
  template:
    metadata:
      labels:
        name: fluentbit
    spec:
      serviceAccountName: fluentbitds
      containers:
        - name: fluent-bit
          imagePullPolicy: Always
          image: fluent/fluent-bit:latest
          volumeMounts:
            - name: varlog
              mountPath: /var/log
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
            - name: fluentbit-config
              mountPath: /fluent-bit/etc/
          resources:
            limits:
              memory: 1500Mi
            requests:
              cpu: 500m
              memory: 500Mi
      # The key point is to set `hostNetwork` to `true` and
      # `dnsPolicy` to `ClusterFirstWithHostNet` that fluent
      # bit DaemonSet could call Kubelet locally.
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      volumes:
        - name: varlog
          hostPath:
            path: /var/log
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
        - name: fluentbit-config
          configMap:
            name: fluentbit-config