Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-8507

[Logging 6.4.z] Fields kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not getting pruned for loki output

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Hide
      Before this update, users could attempt to prune container fields in LokiStack, but the fields would still appear in the output. After this update, we have clarified the LokiStack API specification to reflect that container fields are a permanent fixture of the log schema and cannot be pruned.
      Show
      Before this update, users could attempt to prune container fields in LokiStack, but the fields would still appear in the output. After this update, we have clarified the LokiStack API specification to reflect that container fields are a permanent fixture of the log schema and cannot be pruned.
    • Bug Fix
    • Logging - Sprint 282
    • Moderate

      Description of problem:

      Fields kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not getting pruned for loki output even after applying prun filter

      Version-Release number of selected component (if applicable):

      Logging 6.3

      How reproducible:

      Always

      Steps to Reproduce:

      1> Install Logging with loki stack

      2> Try Filter [A]or  [B]

      [A]

        - name: remove-pod-owner2
          prune:
            notIn:
            - .log_type
            - .message
            - .log_source 

      [B]

        - name: prune-filter
          prune:
            in:
            - .kubernetes.container_name
            - .kubernetes.container.name
            - .kubernetes_container_name
            - .kubernetes_container.name
            - .kubernetes_namespace_name
            - .kubernetes.namespace_name
            - .kubernetes.namespace.name
            - .kubernetes_namespace.name
            - .kubernetes.pod_name
            - .kubernetes.pod.name
            - .kubernetes_pod_name
            - .kubernetes_pod.name 

       

       

      Actual results:

      kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name not pruned

      Expected results:

      Fileds kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name should be pruned or they should be listed as non-prunable fileds in doc

      https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.3/html/configuring_logging/configuring-log-forwarding#logging-content-filter-prune-records_configuring-log-forwarding

       

      Additional info:

      For audit logs where no values are there for 

      kubernetes_container_name, kubernetes_namespace_name, kubernetes_pod_name they are blank still there and not prunable

      NOTE Please see attched images to get clarity on issue

              rhn-support-anli Anping Li
              rhn-support-anisal Apurva Nisal
              Qiaoling Tang Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: