Applying a Parser to the Container in the K8s Sidecar Mode

Scalyr Kubernetes agent doesn't ingest logs from files by default, so we recommend our users to use the sidecar mode to spin up another container in the same application pod for outputting the log lines written to files. The configuration instructions are in my prior KB article, so in this post, I will cover how to assign a parser to a container running in a Kubernetes environment. 

If a pod has multiple containers and you only want to apply log configuration options to a specific container, do so by prefixing the option with the container name. Here is an example pod YAML file that has two containers (nginx and logfile) in a single pod (two-containers). I added the annotation "log.config.scalyr.com/<container-name>.attribute.parser" to the file to apply the parser for the respective containers.

kind: Pod
metadata:
  name: two-containers
  annotations:
    log.config.scalyr.com/log-file.attributes.parser: "custom-parser"
    log.config.scalyr.com/nginx.attributes.parser: "nginx"
spec:
  restartPolicy: Never
  volumes:
  - name: shared-data
    emptyDir: {}

  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: shared-data
      mountPath: /var/log/nginx/log/
  - name: log-file
    image: debian
    volumeMounts:
    - name: shared-data
      mountPath: /var/log
    command: ["/bin/sh", "-c"]
    args:
      - while true; do
          tail -f /var/log/access.log;
        done

After the pod is successfully created, I access the pod and make a curl call to the localhost. Then, I logged back to DataSet to check the pod logs. I can see that the messages were successfully logged and each message was parsed by different parsers.

Here is a graph demonstrates the workflow of this configuration.

You could also refer to the section "applying config options to specific containers in a pod" in our documentation for more information.