Configuring the agent to set custom values for applicationName and subsystemName metadata fields

Configuring the agent to set custom values

You can configure the Logging agent with custom values for the applicationName and subsystemName metadata fields by specifying API options.

• Use -a to specify the applicationName that you want to use.

  By default, the applicationName defaults to the namespace name kubernetes.namespace_name in the Red Hat OpenShift on IBM Cloud or IBM Cloud Kubernetes Service cluster.

  You can also use variables from the environment to set custom values, for example '${POD_NAMESPACE}'.

• Use -s to specify the susbsystemName that you want to use.

  By default, the subsystemName defaults to the container name kubernetes.container_name in Red Hat OpenShift on IBM Cloud or IBM Cloud Kubernetes Service clusters.

  You can also use variables from the environment, for example '${POD_NAME}'.

When setting these metadata fields you have the following options:

• You can set the value to a fixed string. For example, you can use -s 'production'.
• You can use variables from the environment, for example -a '${POD_NAMESPACE}'.
• You can combine a fixed string with variables from the environment, for example -a 'mycluster:${POD_NAME}'.

You can set applicatioName, subsystemName, or both. If a value is not set, the default value is applied. For information about the default values that are set for the applicationName and subsystemName metadata fields, see Metadata.

curl -sSL https://ibm.biz/logs-router-setup | bash -s --   -v 1.1.1   -m IAMAPIKey    -k xxxx   -t Kubernetes   -r eu-es   -p 3443 -s '${POD_NAME}' -a '${POD_NAMESPACE}'

curl -sSL https://ibm.biz/logs-router-setup | bash -s --   -v 1.1.1   -m IAMAPIKey    -k xxxx   -t Kubernetes   -r eu-es   -p 3443 -s '${POD_NAME}' -a 'mycluster-dallas:${POD_NAMESPACE}'

curl -sSL https://ibm.biz/logs-router-setup | bash -s --   -v 1.1.1   -m IAMAPIKey    -k xxxx   -t Kubernetes   -r eu-es   -p 3443 -s 'mysubsystem' -a 'myapp'

Configuring the agent to set custom values based on the log line

You can dynamically add values for application and subsystem name depending on the log line.

The following example shows how to configure an agent for a Kubernetes cluster that adds a custom application name for a JSON formatted message:

1. Add the applicationName to the log line.

   For example, your log line looks as follows: {"level":"info", "msg":"Test message", "applicationName":"my-application"}

2. Add the JSON PARSER plugin to the logger-agent-iks.yaml file to convert a stingify JSON into a JSON object. For more information, see JSON.

   [PARSER]
       # Converts the original log source from a JSON map string to the internal binary representation.
       Name   json
       Format json
       # Time_Key: Set the time in your log entry to the log record time included with the log. If not set, Fluenti Bit uses its own time.
       Time_Key time
       Time_Format %d/%b/%Y:%H:%M:%S %z
       # Time_Keep: To keep all fields in the original log record
       Time_Keep On
   

3. Add the PARSER plugin to the logger-agent-iks.yaml file to extract fields from logs. For more information, see Parser.

   By default, the parser plugin only keeps the parsed fields in its output.

   [FILTER]
      # Name: Specify the name of the parser
      Name parser
      # Match: A pattern that is used to match against the tags that are defined on incoming records.
      Match *
      # Key_Name: Specify the field name in the log to be parsed.
      Key_Name message
      # Parser: Specify the parser name to interpret the field.
      Parser json
      # Reserve_Data: Set to keep all the fields
      Reserve_Data On
      # preserve_key: Set to keep the original key field.
      Preserve_Key On
   

4. Extract the application name by using the Nest filter plugin

   The Nest Filter plugin allows you to operate on or with nested data. Its modes of operation are: nest where it takes a set of records and puts them in a map, and lift where it takes a map by key and lifts its records up. For more information, see Nest.

   applicationName must be at the top level, therefore, you must use the lift operation.

   [FILTER] Name nest Match * Operation lift Nested_under message Wildcard applicationName

With this in place, the "applicationName" for the log line example above would be "my-application" for that particular line.