Proposed title of this feature request

OpenShift logging to support to renaming labels via vector

What is the nature and description of the request?

Currently log filtering with openshift logging does only support send logs to different outputs based on namespace or pod labels.

There seems to be no support for more advanced filters.

what customer wants is to change some metadata labels of openshift log message, because of their internal requirements.

current cluster logforwarder configuration:

spec:
  inputs:
    - application:
        namespaces:
          - demo
      name: demo-logs
  outputs:
    - loki:
        labelKeys:
          - openshift.labels.job
          - log_type
          - streamer
          - kubernetes.namespace_name
          - kubernetes.pod_name
          - kubernetes.container_name
          - kubernetes.labels.app
          - kubernetes.labels.cs-dice/application
          - kubernetes.labels.cs-dice/lane
          - kubernetes.labels.job-name
          - kubernetes.labels.release
        tenantKey: kubernetes.namespace_name
      name: loki-logs
      type: loki
      url: 'http://...:3100'
  pipelines:
    - inputRefs:
        - demo-logs
      labels:
        job: openshift-logging-vector
      name: loki-logs
      outputRefs:
        - loki-logs
 

for example the label "kubernetes.labels.cs-dice/application" is currently converted to "kubernetes_labels_cs-dice_application" and need to rewrite this as just "application".
As per customer, currently this is not supported with openshift logging 5.8.

Another issue is that currently there is no way of separating logs based on whether they were written to stdout or stderr.

It would be nice if there is a field in the json representation of the log message clearly stating if the message was received on stdout or stderr.

Why does the customer need this? (List the business requirements)

when moving to vector label names change which breaks their current logging pipeline

List any affected packages or components.

Openshift logging