I deploy filebeat to openshift 3.11.
the log is json format like this :
{"log":"W0922 10:48:03.257983 1 reflector.go:341] github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:668: watch of *v1.StorageClass ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:48:03.258127725Z"}
{"log":"W0922 10:52:30.614798 1 reflector.go:341] github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:665: watch of *v1.PersistentVolume ended with: The resourceVersion for the provided watch is too old.\n","stream":"stderr","time":"2021-09-22T10:52:30.614938249Z"}
and my config filebeat.yml is below:
inputs:
path: ${path.config}/inputs.d/.yml
reload.enabled: false
modules:
path: ${path.config}/modules.d/.yml
reload.enabled: false
filebeat.autodiscover:
providers:
- type: kubernetes
include_pod_uid: true
hints.enabled: true
templates:
- condition.regexp:
kubernetes.container.name: '.+'
config:
- type: docker
containers:
path: "/var/log/pods/*${data.kubernetes.pod.uid}/"
ids:
- "${data.kubernetes.container.name}"
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after
processors:
- decode_json_fields:
process_array: true
max_depth: 10
target: ""
overwrite_keys: true
fields: ["message"]
processors:
- add_cloud_metadata:
- drop_event:
when:
equals:
kubernetes.container.name: "filebeat" - drop_event:
when:
regexp:
message: "^DBG:"