Setting up Parsers

Parsers

This tutorial will help you configure and name parsers in Kubernetes. If you would like to learn about parsers and how to build them, visit our parsing video series or check out our parser documentation. 

By default, deployment logs being read by the agent will default to the "docker" parser. It is important to change this and separate your parsers logically. When we define custom parsers for different log patterns, it makes it simple to setup parsers as well as manage them later.

For example, if Application A is emitting JSON logs, Application B is emitting access logs, and Application B is emitting error logs, rather than using one parser for all three, it is much better to define a "JSON" parser and an "accessLog" parser. Some clusters have tens or even hundreds of different services. As we scale and begin to add more microservices, using one parser will (1) become unmanageable quickly and (2) increase in complexity due to the accommodation of various patterns. 

Setting Parsers

You can add a custom parser to a pod in a Kubernetes cluster using a Pod Annotation. The following are supported.

Annotation

log.config.scalyr.com/attributes.parser: "custom-parser"

CLI

kubectl annotate pod <pod-name> --overwrite log.config.scalyr.com/attributes.parser=custom-parser

YAML