Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-7889

Fields kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not getting pruned for loki output

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Bug Fix
    • Logging - Sprint 278
    • Moderate

      Description of problem:

      Fields kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not getting pruned for loki output even after applying prun filter

      Version-Release number of selected component (if applicable):

      Logging 6.3

      How reproducible:

      Always

      Steps to Reproduce:

      1> Install Logging with loki stack

      2> Try Filter [A]or  [B]

      [A]

        - name: remove-pod-owner2
          prune:
            notIn:
            - .log_type
            - .message
            - .log_source 

      [B]

        - name: prune-filter
          prune:
            in:
            - .kubernetes.container_name
            - .kubernetes.container.name
            - .kubernetes_container_name
            - .kubernetes_container.name
            - .kubernetes_namespace_name
            - .kubernetes.namespace_name
            - .kubernetes.namespace.name
            - .kubernetes_namespace.name
            - .kubernetes.pod_name
            - .kubernetes.pod.name
            - .kubernetes_pod_name
            - .kubernetes_pod.name 

       

       

      Actual results:

      kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not pruned

      Expected results:

      Fileds kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name should be pruned or they should be listed as non-prunable fileds in doc

      https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.3/html/configuring_logging/configuring-log-forwarding#logging-content-filter-prune-records_configuring-log-forwarding

       

      Additional info:

      For audit logs where no values are there for 

      kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name they are blank still there and not prunable

      NOTE Please see attched images to get clarity on issue

              rh-ee-calee Calvin Lee
              rhn-support-anisal Apurva Nisal
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: