Every annotation Collectord recognizes for the ElasticSearch / OpenSearch output, grouped by the datatype it controls. The list uses the elasticsearch.collectord.io/ prefix, which the ElasticSearch configuration reads (annotationsSubdomain = elasticsearch). The OpenSearch configuration sets annotationsSubdomain = opensearch, so on OpenSearch write each one with the opensearch.collectord.io/ prefix instead. For usage, examples, and patterns, see the companion Annotations page.
26.10Collectord refuses an annotation that would pass a workload’s data off as Collectord’s own records: the source type of one of Collectord’s own inputs (file, journald, events, objects and the rest; the container logs’ own type and yours, such as nginx_access, stay allowed), a user field named like one Collectord sets (syslog.*, systemd.unit, and the namespace, pod and container names and ids), or an extraction group with one of those names. A refused annotation sets nothing: Collectord logs it once per object as invalid annotation, and collectord describe lists it under problems. The configuration can still set any of these.
- General annotations
elasticsearch.collectord.io/index- change the datastream for all the data forwarded for this Pod (metrics, container logs, application logs)elasticsearch.collectord.io/host- change the host for all the data forwarded for this Pod (metrics, container logs, application logs)elasticsearch.collectord.io/output- change the output todevnullorelasticsearchelasticsearch.collectord.io/userfields.{fieldname}- attach custom fields to events
- Annotations for container logs
elasticsearch.collectord.io/logs-index- change the datastream for the container logs forwarded from this Podelasticsearch.collectord.io/logs-host- change the host for the container logs forwarded from this Podelasticsearch.collectord.io/logs-eventpattern- set the regex identifying the event start pattern for Pod logselasticsearch.collectord.io/logs-replace.{N}-search- define the search pattern for the replace pipeelasticsearch.collectord.io/logs-replace.{N}-val- define the replace pattern for the replace pipeelasticsearch.collectord.io/logs-hashing.{N}-match- the regexp for a matched valueelasticsearch.collectord.io/logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)elasticsearch.collectord.io/logs-extraction- define the regexp for fields extractionelasticsearch.collectord.io/logs-extractionMessageField- specify the field name for the message (by default last unnamed group in regexp)elasticsearch.collectord.io/logs-timestampfield- define the field for timestamp (after fields extraction)elasticsearch.collectord.io/logs-timestampformat- define the timestamp formatelasticsearch.collectord.io/logs-timestampsetmonth- define if month should be set to current for timestampelasticsearch.collectord.io/logs-timestampsetday- define if day should be set to current for timestampelasticsearch.collectord.io/logs-timestamplocation- define timestamp location if not set by formatelasticsearch.collectord.io/logs-joinpartial- join partial eventselasticsearch.collectord.io/logs-joinmultiline- join multiline logs (default value depends on[pipe.join] disabled)elasticsearch.collectord.io/logs-eventPatternMaxInterval- (26.10+) join the lines written within this interval of the event’s first line (default:[pipe.join] maxInterval)elasticsearch.collectord.io/logs-eventPatternMaxWait- (26.10+) send a joined event once it is this old (default:[pipe.join] maxWait)elasticsearch.collectord.io/logs-eventPatternMaxSize- (26.10+) cap a joined event at this size (default:[pipe.join] maxSize)elasticsearch.collectord.io/logs-repeat-enabled- (26.10+) send repeated lines as one event that counts them, see Reduce log volumeelasticsearch.collectord.io/logs-repeat-maxspan- (26.10+) how long repeats are held before their event goes out, up to10m(default1m)elasticsearch.collectord.io/logs-repeat-offsets- (26.10+) add every line’s time in milliseconds from the event’s (collectord_repeat_offsets)elasticsearch.collectord.io/logs-fold-enabled- (26.10+) fold storms of alike lines into one summary a minute (lossy)elasticsearch.collectord.io/logs-fold-maxperminute- (26.10+) lines of one pattern sent each minute before the rest fold (default60)elasticsearch.collectord.io/logs-fold-keep- (26.10+) lines never folded; replaces the default(?i)error|exception|fatal|panicelasticsearch.collectord.io/logs-patterns-enabled- (26.10+) report the stream’s heaviest log patternselasticsearch.collectord.io/logs-escapeterminalsequences- escape terminal sequences (including colors)elasticsearch.collectord.io/logs-override.{N}-match- match for override patternelasticsearch.collectord.io/logs-override.{N}-index- override datastream for matched eventselasticsearch.collectord.io/logs-output- change the output todevnullorelasticsearch(this annotation can’t be specified for stderr and stdout)elasticsearch.collectord.io/logs-disabled- disable any log processing for this container (this annotation can’t be specified for stderr and stdout)elasticsearch.collectord.io/logs-sampling-percent- specify the % value of logs that should be forwarded to ElasticSearchelasticsearch.collectord.io/logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valueselasticsearch.collectord.io/logs-ThruputPerSecond- set the thruput for this container, maximum number of logs per second, for example128Kb,1024belasticsearch.collectord.io/logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24helasticsearch.collectord.io/logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30melasticsearch.collectord.io/logs-whitelist- allow configuring a pattern for log messages, only log messages matching this pattern will be forwarded to ElasticSearchelasticsearch.collectord.io/logs-userfields.{fieldname}- attach custom fields to events- Specific for
stdout, with the annotations below you can define configuration specific forstdoutelasticsearch.collectord.io/stdout-logs-indexelasticsearch.collectord.io/stdout-logs-hostelasticsearch.collectord.io/stdout-logs-eventpatternelasticsearch.collectord.io/stdout-logs-replace.{N}-searchelasticsearch.collectord.io/stdout-logs-replace.{N}-valelasticsearch.collectord.io/stdout-logs-hashing.{N}-matchelasticsearch.collectord.io/stdout-logs-hashing.{N}-functionelasticsearch.collectord.io/stdout-logs-extractionelasticsearch.collectord.io/stdout-logs-extractionMessageFieldelasticsearch.collectord.io/stdout-logs-timestampfieldelasticsearch.collectord.io/stdout-logs-timestampformatelasticsearch.collectord.io/stdout-logs-timestampsetmonthelasticsearch.collectord.io/stdout-logs-timestampsetdayelasticsearch.collectord.io/stdout-logs-timestamplocationelasticsearch.collectord.io/stdout-logs-joinpartialelasticsearch.collectord.io/stdout-logs-joinmultilineelasticsearch.collectord.io/stdout-logs-eventPatternMaxInterval- (26.10+)elasticsearch.collectord.io/stdout-logs-eventPatternMaxWait- (26.10+)elasticsearch.collectord.io/stdout-logs-eventPatternMaxSize- (26.10+)elasticsearch.collectord.io/stdout-logs-repeat-enabled- (26.10+)elasticsearch.collectord.io/stdout-logs-repeat-maxspan- (26.10+)elasticsearch.collectord.io/stdout-logs-repeat-offsets- (26.10+)elasticsearch.collectord.io/stdout-logs-fold-enabled- (26.10+)elasticsearch.collectord.io/stdout-logs-fold-maxperminute- (26.10+)elasticsearch.collectord.io/stdout-logs-fold-keep- (26.10+)elasticsearch.collectord.io/stdout-logs-patterns-enabled- (26.10+)elasticsearch.collectord.io/stdout-logs-escapeterminalsequenceselasticsearch.collectord.io/stdout-logs-override.{N}-matchelasticsearch.collectord.io/stdout-logs-override.{N}-indexelasticsearch.collectord.io/stdout-logs-sampling-percentelasticsearch.collectord.io/stdout-logs-sampling-keyelasticsearch.collectord.io/stdout-logs-whitelist
- Specific for
stderr, with the annotations below you can define configuration specific forstderrelasticsearch.collectord.io/stderr-logs-indexelasticsearch.collectord.io/stderr-logs-hostelasticsearch.collectord.io/stderr-logs-eventpatternelasticsearch.collectord.io/stderr-logs-replace.{N}-searchelasticsearch.collectord.io/stderr-logs-replace.{N}-valelasticsearch.collectord.io/stderr-logs-hashing.{N}-matchelasticsearch.collectord.io/stderr-logs-hashing.{N}-functionelasticsearch.collectord.io/stderr-logs-extractionelasticsearch.collectord.io/stderr-logs-extractionMessageFieldelasticsearch.collectord.io/stderr-logs-timestampfieldelasticsearch.collectord.io/stderr-logs-timestampformatelasticsearch.collectord.io/stderr-logs-timestampsetmonthelasticsearch.collectord.io/stderr-logs-timestampsetdayelasticsearch.collectord.io/stderr-logs-timestamplocationelasticsearch.collectord.io/stderr-logs-joinpartialelasticsearch.collectord.io/stderr-logs-joinmultilineelasticsearch.collectord.io/stderr-logs-eventPatternMaxInterval- (26.10+)elasticsearch.collectord.io/stderr-logs-eventPatternMaxWait- (26.10+)elasticsearch.collectord.io/stderr-logs-eventPatternMaxSize- (26.10+)elasticsearch.collectord.io/stderr-logs-repeat-enabled- (26.10+)elasticsearch.collectord.io/stderr-logs-repeat-maxspan- (26.10+)elasticsearch.collectord.io/stderr-logs-repeat-offsets- (26.10+)elasticsearch.collectord.io/stderr-logs-fold-enabled- (26.10+)elasticsearch.collectord.io/stderr-logs-fold-maxperminute- (26.10+)elasticsearch.collectord.io/stderr-logs-fold-keep- (26.10+)elasticsearch.collectord.io/stderr-logs-patterns-enabled- (26.10+)elasticsearch.collectord.io/stderr-logs-escapeterminalsequenceselasticsearch.collectord.io/stderr-logs-override.{N}-matchelasticsearch.collectord.io/stderr-logs-override.{N}-indexelasticsearch.collectord.io/stderr-logs-sampling-percentelasticsearch.collectord.io/stderr-logs-sampling-keyelasticsearch.collectord.io/stderr-logs-whitelist
- Annotations for events (can be applied only to namespaces)
elasticsearch.collectord.io/events-index- change the datastream for the events of specific namespaceelasticsearch.collectord.io/events-host- change the host for the events of specific namespaceelasticsearch.collectord.io/events-userfields.{fieldname}- attach custom fields to eventselasticsearch.collectord.io/events-output- (26.04.1+) change the output for the events published on the namespace
- Annotations for application logs
elasticsearch.collectord.io/volume.{N}-logs-name- name of the volume attached to Podelasticsearch.collectord.io/volume.{N}-logs-index- target datastream for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-output- configure the output for the logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-host- change the host for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-eventpattern- change the event pattern defining new event for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-repeat-enabled- (26.10+) send repeated lines of the volume’s logs as one event that counts themelasticsearch.collectord.io/volume.{N}-logs-fold-enabled- (26.10+) fold storms of alike lines in the volume’s logs (lossy)elasticsearch.collectord.io/volume.{N}-logs-patterns-enabled- (26.10+) report the heaviest log patterns of the volume’s logselasticsearch.collectord.io/volume.{N}-logs-replace.{N}-search- specify the regex search for replace pipe for the logselasticsearch.collectord.io/volume.{N}-logs-replace.{N}-val- specify the regex replace pattern for replace pipe for the logselasticsearch.collectord.io/volume.{N}-logs-hashing.{N}-match- the regexp for a matched valueelasticsearch.collectord.io/volume.{N}-logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)elasticsearch.collectord.io/volume.{N}-logs-extraction- specify the fields extraction with the regex the logselasticsearch.collectord.io/volume.{N}-logs-extractionMessageField- specify the field name for the message (by default last unnamed group in regexp)elasticsearch.collectord.io/volume.{N}-logs-timestampfield- specify the timestamp fieldelasticsearch.collectord.io/volume.{N}-logs-timestampformat- specify the format for timestamp fieldelasticsearch.collectord.io/volume.{N}-logs-timestampsetmonth- define if month should be set to current for timestampelasticsearch.collectord.io/volume.{N}-logs-timestampsetday- define if day should be set to current for timestampelasticsearch.collectord.io/volume.{N}-logs-timestamplocation- define timestamp location if not set by formatelasticsearch.collectord.io/volume.{N}-logs-glob- set the glob pattern for matching logselasticsearch.collectord.io/volume.{N}-logs-match- set the regexp pattern for matching logselasticsearch.collectord.io/volume.{N}-logs-recursive- set if walker should walk the directory recursiveelasticsearch.collectord.io/volume.{N}-logs-override.{N}-match- match for override patternelasticsearch.collectord.io/volume.{N}-logs-override.{N}-index- override datastream for matched eventselasticsearch.collectord.io/volume.{N}-logs-sampling-percent- specify the % value of logs that should be forwarded to ElasticSearchelasticsearch.collectord.io/volume.{N}-logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valueselasticsearch.collectord.io/volume.{N}-logs-ThruputPerSecond- set the thruput for this container, maximum number of logs per second, for example128Kb,1024belasticsearch.collectord.io/volume.{N}-logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24helasticsearch.collectord.io/volume.{N}-logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30melasticsearch.collectord.io/volume.{N}-logs-whitelist- allow configuring pattern for log messages, only log messages matching this pattern will be forwarded to ElasticSearchelasticsearch.collectord.io/volume.{N}-logs-userfields.{fieldname}- attach custom fields to eventselasticsearch.collectord.io/volume.{N}-logs-maxholdafterclose- how long Collectord can hold file descriptors open for files in PVC after pod is terminated (duration5s,1800s)elasticsearch.collectord.io/volume.{N}-logs-onvolumedatabase- boolean flag to enable on a volume database for this volume, in case if this volume might be used on more than one host