Every annotation Collectord recognizes for the ElasticSearch / OpenSearch output, grouped by the datatype it controls. All annotations use the elasticsearch.collectord.io/ prefix because this product sets annotationsSubdomain = elasticsearch. For usage, examples, and patterns, see the companion Annotations page.
- General annotations
elasticsearch.collectord.io/index- change the datastream for all the data forwarded for this Pod (metrics, container logs, application logs)elasticsearch.collectord.io/host- change the host for all the data forwarded for this Pod (metrics, container logs, application logs)elasticsearch.collectord.io/output- change the output todevnullorelasticsearchelasticsearch.collectord.io/userfields.{fieldname}- attach custom fields to events
- Annotations for container logs
elasticsearch.collectord.io/logs-index- change the datastream for the container logs forwarded from this Podelasticsearch.collectord.io/logs-host- change the host for the container logs forwarded from this Podelasticsearch.collectord.io/logs-eventpattern- set the regex identifying the event start pattern for Pod logselasticsearch.collectord.io/logs-replace.{N}-search- define the search pattern for the replace pipeelasticsearch.collectord.io/logs-replace.{N}-val- define the replace pattern for the replace pipeelasticsearch.collectord.io/logs-hashing.{N}-match- the regexp for a matched valueelasticsearch.collectord.io/logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)elasticsearch.collectord.io/logs-extraction- define the regexp for fields extractionelasticsearch.collectord.io/logs-extractionMessageField- specify the field name for the message (by default first unnamed ground in regexp)elasticsearch.collectord.io/logs-timestampfield- define the field for timestamp (after fields extraction)elasticsearch.collectord.io/logs-timestampformat- define the timestamp formatelasticsearch.collectord.io/logs-timestampsetmonth- define if month should be set to current for timestampelasticsearch.collectord.io/logs-timestampsetday- define if day should be set to current for timestampelasticsearch.collectord.io/logs-timestamplocation- define timestamp location if not set by formatelasticsearch.collectord.io/logs-joinpartial- join partial eventselasticsearch.collectord.io/logs-joinmultiline- join multiline logs (default value depends on[pipe.join] disabled)elasticsearch.collectord.io/logs-escapeterminalsequences- escape terminal sequences (including colors)elasticsearch.collectord.io/logs-override.{N}-match- match for override patternelasticsearch.collectord.io/logs-override.{N}-index- override datastream for matched eventselasticsearch.collectord.io/logs-output- change the output todevnullorelasticsearch(this annotation can’t be specified for stderr and stdout)elasticsearch.collectord.io/logs-disabled- disable any log processing for this container (this annotation can’t be specified for stderr and stdout)elasticsearch.collectord.io/logs-sampling-percent- specify the % value of logs that should be forwarded to ElasticSearchelasticsearch.collectord.io/logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valueselasticsearch.collectord.io/logs-ThruputPerSecond- set the thruput for this container, maximum number of logs per second, for example128Kb,1024belasticsearch.collectord.io/logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24helasticsearch.collectord.io/logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30melasticsearch.collectord.io/logs-whitelist- allow configuring a pattern for log messages, only log messages matching this pattern will be forwarded to ElasticSearchelasticsearch.collectord.io/logs-userfields.{fieldname}- attach custom fields to events- Specific for
stdout, with the annotations below you can define configuration specific forstdoutelasticsearch.collectord.io/stdout-logs-indexelasticsearch.collectord.io/stdout-logs-hostelasticsearch.collectord.io/stdout-logs-eventpatternelasticsearch.collectord.io/stdout-logs-replace.{N}-searchelasticsearch.collectord.io/stdout-logs-replace.{N}-valelasticsearch.collectord.io/stdout-logs-hashing.{N}-matchelasticsearch.collectord.io/stdout-logs-hashing.{N}-functionelasticsearch.collectord.io/stdout-logs-extractionelasticsearch.collectord.io/stdout-logs-extractionMessageFieldelasticsearch.collectord.io/stdout-logs-timestampfieldelasticsearch.collectord.io/stdout-logs-timestampformatelasticsearch.collectord.io/stdout-logs-timestampsetmonthelasticsearch.collectord.io/stdout-logs-timestampsetdayelasticsearch.collectord.io/stdout-logs-timestamplocationelasticsearch.collectord.io/stdout-logs-joinpartialelasticsearch.collectord.io/stdout-logs-joinmultilineelasticsearch.collectord.io/stdout-logs-escapeterminalsequenceselasticsearch.collectord.io/stdout-logs-override.{N}-matchelasticsearch.collectord.io/stdout-logs-override.{N}-indexelasticsearch.collectord.io/stdout-logs-sampling-percentelasticsearch.collectord.io/stdout-logs-sampling-keyelasticsearch.collectord.io/stdout-logs-ThruputPerSecondelasticsearch.collectord.io/stdout-logs-TooOldEventselasticsearch.collectord.io/stdout-logs-TooNewEventselasticsearch.collectord.io/stdout-logs-whitelist
- Specific for
stderr, with the annotations below you can define configuration specific forstderrelasticsearch.collectord.io/stderr-logs-indexelasticsearch.collectord.io/stderr-logs-hostelasticsearch.collectord.io/stderr-logs-eventpatternelasticsearch.collectord.io/stderr-logs-replace.{N}-searchelasticsearch.collectord.io/stderr-logs-replace.{N}-valelasticsearch.collectord.io/stderr-logs-hashing.{N}-matchelasticsearch.collectord.io/stderr-logs-hashing.{N}-functionelasticsearch.collectord.io/stderr-logs-extractionelasticsearch.collectord.io/stdout-logs-extractionMessageFieldelasticsearch.collectord.io/stderr-logs-timestampfieldelasticsearch.collectord.io/stderr-logs-timestampformatelasticsearch.collectord.io/stderr-logs-timestampsetmonthelasticsearch.collectord.io/stderr-logs-timestampsetdayelasticsearch.collectord.io/stderr-logs-timestamplocationelasticsearch.collectord.io/stderr-logs-joinpartialelasticsearch.collectord.io/stderr-logs-joinmultilineelasticsearch.collectord.io/stderr-logs-escapeterminalsequenceselasticsearch.collectord.io/stderr-logs-override.{N}-matchelasticsearch.collectord.io/stderr-logs-override.{N}-indexelasticsearch.collectord.io/stderr-logs-sampling-percentelasticsearch.collectord.io/stderr-logs-sampling-keyelasticsearch.collectord.io/stderr-logs-ThruputPerSecondelasticsearch.collectord.io/stderr-logs-TooOldEventselasticsearch.collectord.io/stderr-logs-TooNewEventselasticsearch.collectord.io/stderr-logs-whitelist
- Annotations for events (can be applied only to namespaces)
elasticsearch.collectord.io/events-index- change the datastream for the events of specific namespaceelasticsearch.collectord.io/events-host- change the host for the events of specific namespaceelasticsearch.collectord.io/events-userfields.{fieldname}- attach custom fields to eventselasticsearch.collectord.io/events-output- (26.04.1+) change the output for the events published on the namespace
- Annotations for application logs
elasticsearch.collectord.io/volume.{N}-logs-name- name of the volume attached to Podelasticsearch.collectord.io/volume.{N}-logs-index- target datastream for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-output- configure the output for the logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-host- change the host for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-eventpattern- change the event pattern defining new event for logs forwarded from the volumeelasticsearch.collectord.io/volume.{N}-logs-replace.{N}-search- specify the regex search for replace pipe for the logselasticsearch.collectord.io/volume.{N}-logs-replace.{N}-val- specify the regex replace pattern for replace pipe for the logselasticsearch.collectord.io/volume.{N}-logs-hashing.{N}-match- the regexp for a matched valueelasticsearch.collectord.io/volume.{N}-logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)elasticsearch.collectord.io/volume.{N}-logs-extraction- specify the fields extraction with the regex the logselasticsearch.collectord.io/volume.{N}-logs-extractionMessageField- specify the field name for the message (by default first unnamed ground in regexp)elasticsearch.collectord.io/volume.{N}-logs-timestampfield- specify the timestamp fieldelasticsearch.collectord.io/volume.{N}-logs-timestampformat- specify the format for timestamp fieldelasticsearch.collectord.io/volume.{N}-logs-timestampsetmonth- define if month should be set to current for timestampelasticsearch.collectord.io/volume.{N}-logs-timestampsetday- define if day should be set to current for timestampelasticsearch.collectord.io/volume.{N}-logs-timestamplocation- define timestamp location if not set by formatelasticsearch.collectord.io/volume.{N}-logs-glob- set the glob pattern for matching logselasticsearch.collectord.io/volume.{N}-logs-match- set the regexp pattern for matching logselasticsearch.collectord.io/volume.{N}-logs-recursive- set if walker should walk the directory recursiveelasticsearch.collectord.io/volume.{N}-logs-override.{N}-match- match for override patternelasticsearch.collectord.io/volume.{N}-logs-override.{N}-index- override datastream for matched eventselasticsearch.collectord.io/volume.{N}-logs-sampling-percent- specify the % value of logs that should be forwarded to ElasticSearchelasticsearch.collectord.io/volume.{N}-logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valueselasticsearch.collectord.io/volume.{N}-logs-ThruputPerSecond- set the thruput for this container, maximum number of logs per second, for example128Kb,1024belasticsearch.collectord.io/volume.{N}-logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24helasticsearch.collectord.io/volume.{N}-logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30melasticsearch.collectord.io/volume.{N}-logs-whitelist- allow configuring pattern for log messages, only log messages matching this pattern will be forwarded to ElasticSearchelasticsearch.collectord.io/volume.{N}-logs-userfields.{fieldname}- attach custom fields to eventselasticsearch.collectord.io/volume.{N}-logs-maxholdafterclose- how long Collectord can hold file descriptors open for files in PVC after pod is terminated (duration5s,1800s)elasticsearch.collectord.io/volume.{N}-logs-onvolumedatabase- boolean flag to enable on a volume database for this volume, in case if this volume might be used on more than one host