FluentBit Container Runtime Interface (CRI) parser

Fluent Bit by default assumes that logs are formatted by the Docker interface standard.

However, when using CRI you can run into issues with malformed JSON if you do not modify the parser used.

Fluent Bit includes a CRI log parser that can be used instead.

 

An example of the parser is seen below:

 

# CRI Parser [PARSER]  # http://rubular.com/r/tjUt3Awgg4  Name cri  Format regex  Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$  Time_Key time  Time_Format %Y-%m-%dT%H:%M:%S.%L%z

 

To use this parser change the Input section for your configuration from docker to cri

 

[INPUT]  Name tail  Path /var/log/containers/*.log  Parser cri  Tag kube.*  Mem_Buf_Limit 5MB  Skip_Long_Lines On