feat: collect all pods logs

Author: hranicka

charts/uptrace/templates/otelcol-deployment.yaml

@@ -26,11 +26,17 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /etc/config
+            - name: varlogpods
+              mountPath: /var/log/pods
+              readOnly: true
           imagePullPolicy: IfNotPresent
           env:
             {{- toYaml .Values.uptrace.env | nindent 12 }}
       volumes:
         - name: config
           configMap:
             name: otelcontribcol
+        - name: varlogpods
+          hostPath:
+            path: /var/log/pods
 {{ end }}

charts/uptrace/values.yaml

@@ -113,19 +113,83 @@ otelcol:
         auth_type: "serviceAccount"
         endpoint: "https://${env:K8S_NODE_NAME}:10250"
         insecure_skip_verify: true
+      filelog:
+        include: [ /var/log/pods/*/*/*.log ]
+        include_file_name: false
+        include_file_path: true
+        start_at: end  # Recommended: use "end" for production
+        operators:
+          - type: router
+            id: get-format
+            routes:
+              - expr: body matches "^\\{"
+                output: parser-docker
+              - expr: body matches "^[^ Z]+ "
+                output: parser-crio
+              - expr: body matches "^[^ Z]+Z"
+                output: parser-containerd
+          - type: regex_parser
+            id: parser-crio
+            output: extract_metadata_from_filepath
+            regex: ^(?P<time>[^ Z]+) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$
+            timestamp:
+              layout: 2006-01-02T15:04:05.999999999Z07:00
+              layout_type: gotime
+              parse_from: attributes.time
+          - type: regex_parser
+            id: parser-containerd
+            output: extract_metadata_from_filepath
+            regex: ^(?P<time>[^ ^Z]+Z) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*) ?(?P<log>.*)$
+            timestamp:
+              layout: '%Y-%m-%dT%H:%M:%S.%LZ'
+              parse_from: attributes.time
+          - type: json_parser
+            id: parser-docker
+            output: extract_metadata_from_filepath
+            timestamp:
+              layout: '%Y-%m-%dT%H:%M:%S.%LZ'
+              parse_from: attributes.time
+          - type: regex_parser
+            id: extract_metadata_from_filepath
+            parse_from: attributes["log.file.path"]
+            regex: ^.*\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[a-f0-9\-]+)\/(?P<container_name>[^\._]+)\/(?P<restart_count>\d+)\.log$
+          - type: move
+            from: attributes.stream
+            to: attributes["log.iostream"]
+          - type: move
+            from: attributes.container_name
+            to: resource["k8s.container.name"]
+          - type: move
+            from: attributes.namespace
+            to: resource["k8s.namespace.name"]
+          - type: move
+            from: attributes.pod_name
+            to: resource["k8s.pod.name"]
+          - type: move
+            from: attributes.restart_count
+            to: resource["k8s.container.restart_count"]
+          - type: move
+            from: attributes.uid
+            to: resource["k8s.pod.uid"]
+          - type: move
+            from: attributes.log
+            to: body
+
     processors:
       resourcedetection:
-        detectors: ['system']
+        detectors: ['system', 'k8snode']
       cumulativetodelta:
       batch:
         send_batch_size: 10000
         timeout: 15s
+
     exporters:
       debug:
       otlp/local:
         endpoint: http://my-uptrace:14317
         tls: { insecure: true }
         headers: { 'uptrace-dsn': 'http://project1_secret_token@localhost:14317/1' }
+
     service:
       pipelines:
         traces:
@@ -137,8 +201,8 @@ otelcol:
           processors: [cumulativetodelta, batch]
           exporters: [debug, otlp/local]
         logs:
-          receivers: [otlp, k8s_cluster]
-          processors: [batch]
+          receivers: [otlp, k8s_cluster, filelog]
+          processors: [batch, resourcedetection]
           exporters: [debug, otlp/local]
 
 nameOverride: ''