Look up every container label Collectord recognizes, grouped by the datatype it controls. Collectord accepts both the collectord.io/{label} and io.collectord.{label} forms. For usage, examples and patterns, see the companion Container annotations page.
26.10Collectord refuses a label that would pass a container’s data off as Collectord’s own records:
- Source types. The source type of one of Collectord’s own inputs:
docker_host_logs,docker_events,docker_stats_v2_hostand the rest. The container logs’ own type and yours, such asnginx_access, stay allowed. - User fields. A user field named like one Collectord sets:
syslog_*,systemd_unit,sourcetype, and the container’s name and id. - Extraction groups. An extraction group with one of those names.
A refused label sets nothing. Collectord logs it once per container as invalid annotation, and collectord describe lists it under problems. The configuration can still set any of these.
- General annotations
collectord.io/index- change the events index for all the data forwarded for this container: container logs, application logs, and stats and Prometheus metrics sent to an events index. A metrics index comes from elsewhere: see Events index and metrics indexcollectord.io/source- change the source for all the data forwarded for this container (metrics, container logs, application logs)collectord.io/type- change the sourcetype for all the data forwarded for this container (metrics, container logs, application logs)collectord.io/host- change the host for all the data forwarded for this container (metrics, container logs, application logs)collectord.io/output- change the output for all the data forwarded for this container:devnull,splunk, or a named output assplunk::<name>collectord.io/userfields.{fieldname}- attach custom fields to events
- Annotations for container logs
collectord.io/logs-index- change the index for the container logs forwarded from this containercollectord.io/logs-source- change the source for the container logs forwarded from this containercollectord.io/logs-type- change the sourcetype for the container logs forwarded from this containercollectord.io/logs-host- change the host for the container logs forwarded from this containercollectord.io/logs-eventpattern- the regex that matches the first line of each event in the container’s logscollectord.io/logs-replace.{N}-search- the regex the replace pipe searches forcollectord.io/logs-replace.{N}-val- the replacement for the replace pipecollectord.io/logs-hashing.{N}-match- the regex matching the value to hashcollectord.io/logs-hashing.{N}-function- the hash function (defaultsha256):adler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384orsha512collectord.io/logs-extraction- the regex for field extractioncollectord.io/logs-extractionMessageField- the field that becomes the message (default: the regex’s last unnamed group)collectord.io/logs-timestampfield- the extracted field that holds the timestampcollectord.io/logs-timestampformat- the timestamp formatcollectord.io/logs-timestampsetmonth- set the timestamp’s month to the current monthcollectord.io/logs-timestampsetday- set the timestamp’s day to the current daycollectord.io/logs-timestamplocation- the timestamp’s location, when the format sets nonecollectord.io/logs-joinpartial- join partial eventscollectord.io/logs-joinmultiline- join multiline logs (the default depends on[pipe.join] disabled)collectord.io/logs-eventPatternMaxInterval- (26.10+) join the lines written within this interval of the event’s first line (default:[pipe.join] maxInterval)collectord.io/logs-eventPatternMaxWait- (26.10+) send a joined event once it is this old (default:[pipe.join] maxWait)collectord.io/logs-eventPatternMaxSize- (26.10+) cap a joined event at this size (default:[pipe.join] maxSize)collectord.io/logs-repeat-enabled- (26.10+) send repeated lines as one event that counts them: see Reduce log volumecollectord.io/logs-repeat-maxspan- (26.10+) how long repeats are held before their event goes out, up to10m(default1m)collectord.io/logs-repeat-offsets- (26.10+) add each line’s time, in milliseconds from the event’s, ascollectord_repeat_offsetscollectord.io/logs-fold-enabled- (26.10+) fold storms of alike lines into one summary a minute (lossy)collectord.io/logs-fold-maxperminute- (26.10+) lines of one pattern sent each minute before the rest fold (default60)collectord.io/logs-fold-keep- (26.10+) lines never folded; replaces the default(?i)error|exception|fatal|paniccollectord.io/logs-patterns-enabled- (26.10+) report the stream’s heaviest log patternscollectord.io/logs-escapeterminalsequences- escape terminal sequences (including colors)collectord.io/logs-override.{N}-match- the regex that selects the events to overridecollectord.io/logs-override.{N}-index- the index for the matched eventscollectord.io/logs-override.{N}-source- the source for the matched eventscollectord.io/logs-override.{N}-type- the type for the matched eventscollectord.io/logs-output- change the output:devnull,splunk, or any outputcollectord.io/outputtakes (not available forstdoutorstderralone)collectord.io/logs-disabled- disable all log processing for this container (not available forstdoutorstderralone)collectord.io/logs-sampling-percent- the percentage of logs to forward to Splunkcollectord.io/logs-sampling-key- a regex selecting the key for hash-based samplingcollectord.io/logs-ThruputPerSecond- the maximum amount of logs per second for this container, for example128Kb,1024bcollectord.io/logs-TooOldEvents- ignore events older than this duration, for example168h,24hcollectord.io/logs-TooNewEvents- ignore events more than this duration in the future, for example1h,30mcollectord.io/logs-whitelist- forward to Splunk only the log messages matching this patterncollectord.io/logs-userfields.{fieldname}- attach custom fields to events- Settings for
stdoutalone:collectord.io/stdout-logs-indexcollectord.io/stdout-logs-sourcecollectord.io/stdout-logs-typecollectord.io/stdout-logs-hostcollectord.io/stdout-logs-eventpatterncollectord.io/stdout-logs-replace.{N}-searchcollectord.io/stdout-logs-replace.{N}-valcollectord.io/stdout-logs-hashing.{N}-matchcollectord.io/stdout-logs-hashing.{N}-functioncollectord.io/stdout-logs-extractioncollectord.io/stdout-logs-extractionMessageFieldcollectord.io/stdout-logs-timestampfieldcollectord.io/stdout-logs-timestampformatcollectord.io/stdout-logs-timestampsetmonthcollectord.io/stdout-logs-timestampsetdaycollectord.io/stdout-logs-timestamplocationcollectord.io/stdout-logs-joinpartialcollectord.io/stdout-logs-joinmultilinecollectord.io/stdout-logs-eventPatternMaxInterval(26.10+)collectord.io/stdout-logs-eventPatternMaxWait(26.10+)collectord.io/stdout-logs-eventPatternMaxSize(26.10+)collectord.io/stdout-logs-repeat-enabled(26.10+)collectord.io/stdout-logs-repeat-maxspan(26.10+)collectord.io/stdout-logs-repeat-offsets(26.10+)collectord.io/stdout-logs-fold-enabled(26.10+)collectord.io/stdout-logs-fold-maxperminute(26.10+)collectord.io/stdout-logs-fold-keep(26.10+)collectord.io/stdout-logs-patterns-enabled(26.10+)collectord.io/stdout-logs-escapeterminalsequencescollectord.io/stdout-logs-override.{N}-matchcollectord.io/stdout-logs-override.{N}-indexcollectord.io/stdout-logs-override.{N}-sourcecollectord.io/stdout-logs-override.{N}-typecollectord.io/stdout-logs-sampling-percentcollectord.io/stdout-logs-sampling-keycollectord.io/stdout-logs-whitelist
- Settings for
stderralone:collectord.io/stderr-logs-indexcollectord.io/stderr-logs-sourcecollectord.io/stderr-logs-typecollectord.io/stderr-logs-hostcollectord.io/stderr-logs-eventpatterncollectord.io/stderr-logs-replace.{N}-searchcollectord.io/stderr-logs-replace.{N}-valcollectord.io/stderr-logs-hashing.{N}-matchcollectord.io/stderr-logs-hashing.{N}-functioncollectord.io/stderr-logs-extractioncollectord.io/stderr-logs-extractionMessageFieldcollectord.io/stderr-logs-timestampfieldcollectord.io/stderr-logs-timestampformatcollectord.io/stderr-logs-timestampsetmonthcollectord.io/stderr-logs-timestampsetdaycollectord.io/stderr-logs-timestamplocationcollectord.io/stderr-logs-joinpartialcollectord.io/stderr-logs-joinmultilinecollectord.io/stderr-logs-eventPatternMaxInterval(26.10+)collectord.io/stderr-logs-eventPatternMaxWait(26.10+)collectord.io/stderr-logs-eventPatternMaxSize(26.10+)collectord.io/stderr-logs-repeat-enabled(26.10+)collectord.io/stderr-logs-repeat-maxspan(26.10+)collectord.io/stderr-logs-repeat-offsets(26.10+)collectord.io/stderr-logs-fold-enabled(26.10+)collectord.io/stderr-logs-fold-maxperminute(26.10+)collectord.io/stderr-logs-fold-keep(26.10+)collectord.io/stderr-logs-patterns-enabled(26.10+)collectord.io/stderr-logs-escapeterminalsequencescollectord.io/stderr-logs-override.{N}-matchcollectord.io/stderr-logs-override.{N}-indexcollectord.io/stderr-logs-override.{N}-sourcecollectord.io/stderr-logs-override.{N}-typecollectord.io/stderr-logs-sampling-percentcollectord.io/stderr-logs-sampling-keycollectord.io/stderr-logs-whitelist
- Annotations for container stats
collectord.io/stats-index- change the index for the container metrics forwarded from this containercollectord.io/stats-source- change the source for the container metrics forwarded from this containercollectord.io/stats-type- change the sourcetype for the container metrics forwarded from this containercollectord.io/stats-host- change the host for the container metrics forwarded from this containercollectord.io/stats-output- change the output:devnull,splunk, or any outputcollectord.io/outputtakescollectord.io/stats-interval- how often to collect stats, overriding the default intervalcollectord.io/stats-userfields.{fieldname}- attach custom fields to events
- Annotations for container processes stats
collectord.io/procstats-index- change the index for the container process metrics forwarded from this containercollectord.io/procstats-source- change the source for the container process metrics forwarded from this containercollectord.io/procstats-type- change the type for the container process metrics forwarded from this containercollectord.io/procstats-host- change the host for the container process metrics forwarded from this containercollectord.io/procstats-output- change the output:devnull,splunk, or any outputcollectord.io/outputtakescollectord.io/procstats-userfields.{fieldname}- attach custom fields to eventscollectord.io/procstats-hideargs- (5.24.440+) hide the processes’ command-line arguments
- Annotations for container network stats
collectord.io/netstats-index- change the index for the container network metrics forwarded from this containercollectord.io/netstats-source- change the source for the container network metrics forwarded from this containercollectord.io/netstats-type- change the type for the container network metrics forwarded from this containercollectord.io/netstats-host- change the host for the container network metrics forwarded from this containercollectord.io/netstats-output- change the output:devnull,splunk, or any outputcollectord.io/outputtakescollectord.io/netstats-interval- how often to collect stats, overriding the default intervalcollectord.io/netstats-userfields.{fieldname}- attach custom fields to events
- Annotations for container network socket table
collectord.io/nettable-index- change the index for the container network socket table forwarded from this containercollectord.io/nettable-source- change the source for the container network socket table forwarded from this containercollectord.io/nettable-type- change the type for the container network socket table forwarded from this containercollectord.io/nettable-host- change the host for the container network socket table forwarded from this containercollectord.io/nettable-output- change the output:devnull,splunk, or any outputcollectord.io/outputtakescollectord.io/nettable-interval- how often to collect the socket table, overriding the default intervalcollectord.io/nettable-userfields.{fieldname}- attach custom fields to events
- Annotations for application logs
collectord.io/volume.{N}-logs-name- the name of the volume attached to the containercollectord.io/volume.{N}-logs-index- the index for the logs forwarded from the volumecollectord.io/volume.{N}-logs-output- the output for the logs forwarded from the volumecollectord.io/volume.{N}-logs-source- change the source for logs forwarded from the volumecollectord.io/volume.{N}-logs-type- change the type for logs forwarded from the volumecollectord.io/volume.{N}-logs-host- change the host for logs forwarded from the volumecollectord.io/volume.{N}-logs-eventpattern- the regex that matches the first line of each event in the volume’s logscollectord.io/volume.{N}-logs-repeat-enabled- (26.10+) send repeated lines of the volume’s logs as one event that counts themcollectord.io/volume.{N}-logs-fold-enabled- (26.10+) fold storms of alike lines in the volume’s logs (lossy)collectord.io/volume.{N}-logs-patterns-enabled- (26.10+) report the heaviest log patterns of the volume’s logscollectord.io/volume.{N}-logs-replace.{N}-search- the regex the replace pipe searches forcollectord.io/volume.{N}-logs-replace.{N}-val- the replacement for the replace pipecollectord.io/volume.{N}-logs-hashing.{N}-match- the regex matching the value to hashcollectord.io/volume.{N}-logs-hashing.{N}-function- the hash function (defaultsha256):adler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384orsha512collectord.io/volume.{N}-logs-extraction- the regex for field extractioncollectord.io/volume.{N}-logs-extractionMessageField- the field that becomes the message (default: the regex’s last unnamed group)collectord.io/volume.{N}-logs-timestampfield- the field that holds the timestampcollectord.io/volume.{N}-logs-timestampformat- the timestamp formatcollectord.io/volume.{N}-logs-timestampsetmonth- set the timestamp’s month to the current monthcollectord.io/volume.{N}-logs-timestampsetday- set the timestamp’s day to the current daycollectord.io/volume.{N}-logs-timestamplocation- the timestamp’s location, when the format sets nonecollectord.io/volume.{N}-logs-glob- the glob pattern that selects the log filescollectord.io/volume.{N}-logs-match- the regex that selects the log filescollectord.io/volume.{N}-logs-recursive- whether to walk the volume’s directories recursivelycollectord.io/volume.{N}-logs-override.{N}-match- the regex that selects the events to overridecollectord.io/volume.{N}-logs-override.{N}-index- the index for the matched eventscollectord.io/volume.{N}-logs-override.{N}-source- the source for the matched eventscollectord.io/volume.{N}-logs-override.{N}-type- the type for the matched eventscollectord.io/volume.{N}-logs-sampling-percent- the percentage of logs to forward to Splunkcollectord.io/volume.{N}-logs-sampling-key- a regex selecting the key for hash-based samplingcollectord.io/volume.{N}-logs-ThruputPerSecond- the maximum amount of logs per second for this container, for example128Kb,1024bcollectord.io/volume.{N}-logs-TooOldEvents- ignore events older than this duration, for example168h,24hcollectord.io/volume.{N}-logs-TooNewEvents- ignore events more than this duration in the future, for example1h,30mcollectord.io/volume.{N}-logs-whitelist- forward to Splunk only the log messages matching this patterncollectord.io/volume.{N}-logs-userfields.{fieldname}- attach custom fields to eventscollectord.io/volume.{N}-logs-maxholdafterclose- how long Collectord may keep the volume’s files open after the container terminates, as a duration such as5sor1800s
- Annotations for forwarding metrics in Prometheus format (available since 26.04)
collectord.io/prometheus.{N}-port- (required) the port to collect metrics fromcollectord.io/prometheus.{N}-index- the index for the metricscollectord.io/prometheus.{N}-source- the source for the metrics (default/docker/container/{container_id})collectord.io/prometheus.{N}-type- the type for the metrics (default: set in[input.prometheus_auto]in the Collectord configuration)collectord.io/prometheus.{N}-host- the host for the metrics (default: the Docker host’s name, thehostof every other event)collectord.io/prometheus.{N}-path- the URL path of the metricscollectord.io/prometheus.{N}-query- the raw URL query for the metricscollectord.io/prometheus.{N}-interval- how often to collect metrics (default: set in[input.prometheus_auto]in the Collectord configuration)collectord.io/prometheus.{N}-includehelp- include the metrics’ help text (defaultfalse)collectord.io/prometheus.{N}-insecure- skip certificate verification when the scheme ishttps(defaultfalse)collectord.io/prometheus.{N}-scheme- the scheme,httporhttps(defaulthttp)collectord.io/prometheus.{N}-username- the basic auth usernamecollectord.io/prometheus.{N}-password- the basic auth passwordcollectord.io/prometheus.{N}-whitelist- the whitelist regexcollectord.io/prometheus.{N}-blacklist- the blacklist regexcollectord.io/prometheus.{N}-authorizationkey- send the Authorization header thatauthorization.{key}sets under[input.prometheus_auto]in the Collectord configurationcollectord.io/prometheus.{N}-caname- the hostname to verify on the returned certificates, unlessinsecureis setcollectord.io/prometheus.{N}-output- the output for the metricscollectord.io/prometheus.{N}-indexType- the index type for the metrics:events,metrics, or (26.10+)both(default: theindexTypeof[input.prometheus_auto], else[general] defaultIndexType, elseevents)collectord.io/prometheus.{N}-metricsIndex- (26.10+) the metrics index for the metrics (default:[input.prometheus_auto]’smetricsIndex, else the output’sdefaultMetricsIndex; on an output of the workload’s own, that output’sdefaultMetricsIndex; see Events index and metrics index)collectord.io/prometheus.{N}-metricsOutput- (26.10+) send the metrics through another Splunk output, one whose HEC token allows the metrics index