Outcold Solutions - Monitoring Kubernetes, OpenShift and Docker in Splunk
Monitoring Docker in Splunk Monitoring Kubernetes in Splunk Monitoring OpenShift in Splunk Monitoring Linux in Splunk Monitoring Windows Containers in Splunk Forwarding Logs to Elasticsearch and OpenSearch Forwarding Logs to QRadar
Documentation Blog Contact Us Pricing Evaluation licenses Partners License Agreement Privacy Policy FAQ
Monitoring Docker

Container labels reference

Every container label Collectord recognizes, grouped by the datatype it controls. Both collectord.io/{label} and io.collectord.{label} forms are accepted. For usage, examples, and patterns, see the companion Container annotations page.

  • General annotations
    • collectord.io/index - change the index for all the data forwarded for this container (metrics, container logs, application logs)
    • collectord.io/source - change the source for all the data forwarded for this container (metrics, container logs, application logs)
    • collectord.io/type - change the sourcetype for all the data forwarded for this container (metrics, container logs, application logs)
    • collectord.io/host - change the host for all the data forwarded for this container (metrics, container logs, application logs)
    • collectord.io/output - (5.2+) change the output to devnull or splunk
    • collectord.io/userfields.{fieldname} - (5.15.300+) attach custom fields to events
  • Annotations for container logs
    • collectord.io/logs-index - change the index for the container logs forwarded from this container
    • collectord.io/logs-source - change the source for the container logs forwarded from this container
    • collectord.io/logs-type - change the sourcetype for the container logs forwarded from this container
    • collectord.io/logs-host - change the host for the container logs forwarded from this container
    • collectord.io/logs-eventpattern - set the regex identifying the event start pattern for container logs
    • collectord.io/logs-replace.{N}-search - define the search pattern for the replace pipe
    • collectord.io/logs-replace.{N}-val - define the replace pattern for the replace pipe
    • collectord.io/logs-hashing.{N}-match - (5.3+) the regexp for a matched value
    • collectord.io/logs-hashing.{N}-function - (5.3+) hash function (default is sha256, available adler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)
    • collectord.io/logs-extraction - define the regexp for fields extraction
    • collectord.io/logs-extractionMessageField - (5.18+) specify the field name for the message (by default first unnamed ground in regexp)
    • collectord.io/logs-timestampfield - define the field for timestamp (after fields extraction)
    • collectord.io/logs-timestampformat - define the timestamp format
    • collectord.io/logs-timestampsetmonth - define if month should be set to current for timestamp
    • collectord.io/logs-timestampsetday - define if day should be set to current for timestamp
    • collectord.io/logs-timestamplocation - define timestamp location if not set by format
    • collectord.io/logs-joinpartial - join partial events
    • collectord.io/logs-joinmultiline - (5.3+) join multiline logs (default value depends on [pipe.join] disabled)
    • collectord.io/logs-escapeterminalsequences - escape terminal sequences (including colors)
    • collectord.io/logs-override.{N}-match - (5.2+) match for override pattern
    • collectord.io/logs-override.{N}-index - (5.2+) override index for matched events
    • collectord.io/logs-override.{N}-source - (5.2+) override source for matched events
    • collectord.io/logs-override.{N}-type - (5.2+) override type for matched events
    • collectord.io/logs-output - (5.2+) change the output to devnull or splunk (this annotation cannot be specified for stderr and stdout)
    • collectord.io/logs-disabled - (5.3+) disable any log processing for this container (this annotation cannot be specified for stderr and stdout)
    • collectord.io/logs-sampling-percent - (5.6+) specify the % value of logs that should be forwarded to splunk
    • collectord.io/logs-sampling-key - (5.6+) regexp pattern to specify the key for the sampling based on hash values
    • collectord.io/logs-ThruputPerSecond - (5.10.252+) set the thruput for this container, maximum amount of logs per second, for example 128Kb, 1024b
    • collectord.io/logs-TooOldEvents - (5.10.252+) duration of events from now to past that are considered too old and should be ignored, for example 168h, 24h
    • collectord.io/logs-TooNewEvents - (5.10.252+) duration of events from now to the future that are considered too new and should be ignored, for example 1h, 30m
    • collectord.io/logs-whitelist - (5.14.284+) allow to configure pattern for log messages, only log messages matching this pattern will be forwarded to Splunk
    • collectord.io/logs-userfields.{fieldname} - (5.15.300+) attach custom fields to events
    • Specific for stdout, with the annotations below you can define configuration specific for stdout
      • collectord.io/stdout-logs-index
      • collectord.io/stdout-logs-source
      • collectord.io/stdout-logs-type
      • collectord.io/stdout-logs-host
      • collectord.io/stdout-logs-eventpattern
      • collectord.io/stdout-logs-replace.{N}-search
      • collectord.io/stdout-logs-replace.{N}-val
      • collectord.io/stdout-logs-hashing.{N}-match - (5.3+)
      • collectord.io/stdout-logs-hashing.{N}-function - (5.3+)
      • collectord.io/stdout-logs-extraction
      • collectord.io/stdout-logs-extractionMessageField - (5.18+)
      • collectord.io/stdout-logs-timestampfield
      • collectord.io/stdout-logs-timestampformat
      • collectord.io/stdout-logs-timestampsetmonth
      • collectord.io/stdout-logs-timestampsetday
      • collectord.io/stdout-logs-timestamplocation
      • collectord.io/stdout-logs-joinpartial
      • collectord.io/stdout-logs-joinmultiline - (5.3+)
      • collectord.io/stdout-logs-escapeterminalsequences
      • collectord.io/stdout-logs-override.{N}-match - (5.2+)
      • collectord.io/stdout-logs-override.{N}-index - (5.2+)
      • collectord.io/stdout-logs-override.{N}-source - (5.2+)
      • collectord.io/stdout-logs-override.{N}-type - (5.2+)
      • collectord.io/stdout-logs-sampling-percent - (5.6+)
      • collectord.io/stdout-logs-sampling-key - (5.6+)
      • collectord.io/stdout-logs-ThruputPerSecond - (5.10.252+)
      • collectord.io/stdout-logs-TooOldEvents - (5.10.252+)
      • collectord.io/stdout-logs-TooNewEvents - (5.10.252+)
      • collectord.io/stdout-logs-whitelist - (5.14.284+)
    • Specific for stderr, with the annotations below you can define configuration specific for stderr
      • collectord.io/stderr-logs-index
      • collectord.io/stderr-logs-source
      • collectord.io/stderr-logs-type
      • collectord.io/stderr-logs-host
      • collectord.io/stderr-logs-eventpattern
      • collectord.io/stderr-logs-replace.{N}-search
      • collectord.io/stderr-logs-replace.{N}-val
      • collectord.io/stderr-logs-hashing.{N}-match - (5.3+)
      • collectord.io/stderr-logs-hashing.{N}-function - (5.3+)
      • collectord.io/stderr-logs-extraction
      • collectord.io/stdout-logs-extractionMessageField - (5.18+)
      • collectord.io/stderr-logs-timestampfield
      • collectord.io/stderr-logs-timestampformat
      • collectord.io/stderr-logs-timestampsetmonth
      • collectord.io/stderr-logs-timestampsetday
      • collectord.io/stderr-logs-timestamplocation
      • collectord.io/stderr-logs-joinpartial
      • collectord.io/stderr-logs-joinmultiline - (5.3+)
      • collectord.io/stderr-logs-escapeterminalsequences
      • collectord.io/stderr-logs-override.{N}-match - (5.2+)
      • collectord.io/stderr-logs-override.{N}-index - (5.2+)
      • collectord.io/stderr-logs-override.{N}-source - (5.2+)
      • collectord.io/stderr-logs-override.{N}-type - (5.2+)
      • collectord.io/stderr-logs-sampling-percent - (5.6+)
      • collectord.io/stderr-logs-sampling-key - (5.6+)
      • collectord.io/stderr-logs-ThruputPerSecond - (5.10.252+)
      • collectord.io/stderr-logs-TooOldEvents - (5.10.252+)
      • collectord.io/stderr-logs-TooNewEvents - (5.10.252+)
      • collectord.io/stderr-logs-whitelist - (5.14.284+)
  • Annotations for container stats
    • collectord.io/stats-index - change the index for the container metrics forwarded from this container
    • collectord.io/stats-source - change the source for the container metrics forwarded from this container
    • collectord.io/stats-type - change the sourcetype for the container metrics forwarded from this container
    • collectord.io/stats-host - change the host for the container metrics forwarded from this container
    • collectord.io/stats-output - (5.2+) change the output to devnull or splunk
    • collectord.io/stats-interval - (5.14+) override default interval how often to collect stats
    • collectord.io/stats-userfields.{fieldname} - (5.15.300+) attach custom fields to events
  • Annotations for container processes stats
    • collectord.io/procstats-index - change the index for the container process metrics forwarded from this container
    • collectord.io/procstats-source - change the source for the container process metrics forwarded from this container
    • collectord.io/procstats-type - change the type for the container process metrics forwarded from this container
    • collectord.io/procstats-host - change the host for the container process metrics forwarded from this container
    • collectord.io/procstats-output - (5.2+) change the output to devnull or splunk
    • collectord.io/procstats-userfields.{fieldname} - (5.15.300+) attach custom fields to events
    • collectord.io/procstats-hideargs - (5.24.440+) hide the command line arguments for the process
  • Annotations for container network stats
    • collectord.io/netstats-index - change the index for the container network metrics forwarded from this Pod
    • collectord.io/netstats-source - change the source for the container network metrics forwarded from this Pod
    • collectord.io/netstats-type - change the type for the container network metrics forwarded from this Pod
    • collectord.io/netstats-host - change the host for the container network metrics forwarded from this Pod
    • collectord.io/netstats-output - (5.2+) change the output to devnull or splunk
    • collectord.io/netstats-interval - (5.14+) override default interval how often to collect stats
    • collectord.io/netstats-userfields.{fieldname} - (5.15.300+) attach custom fields to events
  • Annotations for container network socket table
    • collectord.io/nettable-index - change the index for the container network socket table forwarded from this Pod
    • collectord.io/nettable-source - change the source for the container network socket table forwarded from this Pod
    • collectord.io/nettable-type - change the type for the container network socket table forwarded from this Pod
    • collectord.io/nettable-host - change the host for the container network socket table forwarded from this Pod
    • collectord.io/nettable-output - (5.2+) change the output to devnull or splunk
    • collectord.io/nettable-interval - (5.14+) override default interval how often to collect stats
    • collectord.io/nettable-userfields.{fieldname} - (5.15.300+) attach custom fields to events
  • Annotations for application logs
    • collectord.io/volume.{N}-logs-name - name of the volume attached to container
    • collectord.io/volume.{N}-logs-index - target index for logs forwarded from the volume
    • collectord.io/volume.{N}-logs-output - configure the output for the logs forwarded from the volume
    • collectord.io/volume.{N}-logs-source - change the source for logs forwarded from the volume
    • collectord.io/volume.{N}-logs-type - change the type for logs forwarded from the volume
    • collectord.io/volume.{N}-logs-host - change the host for logs forwarded from the volume
    • collectord.io/volume.{N}-logs-eventpattern - change the event pattern defining new event for logs forwarded from the volume
    • collectord.io/volume.{N}-logs-replace.{N}-search - specify the regex search for replace pipe for the logs
    • collectord.io/volume.{N}-logs-replace.{N}-val - specify the regex replace pattern for replace pipe for the logs
    • collectord.io/volume.{N}-logs-hashing.{N}-match - (5.3+) the regexp for a matched value
    • collectord.io/volume.{N}-logs-hashing.{N}-function - (5.3+) hash function (default is sha256, available adler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)
    • collectord.io/volume.{N}-logs-extraction - specify the fields extraction with the regex the logs
    • collectord.io/volume.{N}-logs-extractionMessageField - (5.18+) specify the field name for the message (by default first unnamed ground in regexp)
    • collectord.io/volume.{N}-logs-timestampfield - specify the timestamp field
    • collectord.io/volume.{N}-logs-timestampformat - specify the format for timestamp field
    • collectord.io/volume.{N}-logs-timestampsetmonth - define if month should be set to current for timestamp
    • collectord.io/volume.{N}-logs-timestampsetday - define if day should be set to current for timestamp
    • collectord.io/volume.{N}-logs-timestamplocation - define timestamp location if not set by format
    • collectord.io/volume.{N}-logs-glob - set the glob pattern for matching logs
    • collectord.io/volume.{N}-logs-match - set the regexp pattern for matching logs
    • collectord.io/volume.{N}-logs-recursive - set if walker should walk the directory recursive
    • collectord.io/volume.{N}-logs-override.{N}-match - (5.2+) match for override pattern
    • collectord.io/volume.{N}-logs-override.{N}-index - (5.2+) override index for matched events
    • collectord.io/volume.{N}-logs-override.{N}-source - (5.2+) override source for matched events
    • collectord.io/volume.{N}-logs-override.{N}-type - (5.2+) override type for matched events
    • collectord.io/volume.{N}-logs-sampling-percent - (5.6+) specify the % value of logs that should be forwarded to splunk
    • collectord.io/volume.{N}-logs-sampling-key - (5.6+) regexp pattern to specify the key for the sampling based on hash values
    • collectord.io/volume.{N}-logs-ThruputPerSecond - (5.10.252+) set the thruput for this container, maximum amount of logs per second, for example 128Kb, 1024b
    • collectord.io/volume.{N}-logs-TooOldEvents - (5.10.252+) duration of events from now to past that are considered too old and should be ignored, for example 168h, 24h
    • collectord.io/volume.{N}-logs-TooNewEvents - (5.10.252+) duration of events from now to the future that are considered too new and should be ignored, for example 1h, 30m
    • collectord.io/volume.{N}-logs-whitelist - (5.14.284+) allow to configure pattern for log messages, only log messages matching this pattern will be forwarded to Splunk
    • collectord.io/volume.{N}-logs-userfields.{fieldname} - (5.15.300+) attach custom fields to events
    • collectord.io/volume.{N}-logs-maxholdafterclose - (5.18.381+) how long Collectord can hold file descriptors open for files in the volume after container is terminated (duration 5s, 1800s)
  • Annotations for forwarding metrics in Prometheus format (available since 26.04)
    • collectord.io/prometheus.{N}-port - (required) specify the port that needs to be used to collect metrics
    • collectord.io/prometheus.{N}-index - specify target index for the metrics
    • collectord.io/prometheus.{N}-source - specify target source for the metrics (default is /collectord/container/{container_id})
    • collectord.io/prometheus.{N}-type - specify the type for the metrics (default is set in [input.prometheus_auto] of collectord configuration)
    • collectord.io/prometheus.{N}-host - specify the host for the metrics (by default node name is used)
    • collectord.io/prometheus.{N}-path - specify the path in url for the metrics
    • collectord.io/prometheus.{N}-query - specify the raw query in url for the metrics
    • collectord.io/prometheus.{N}-interval - how often to collect metrics (default is set in [input.prometheus_auto] of collectord configuration)
    • collectord.io/prometheus.{N}-includehelp - include help for metrics (default is false)
    • collectord.io/prometheus.{N}-insecure - insecure if scheme is https (default is false)
    • collectord.io/prometheus.{N}-scheme - scheme (http or https, default is http)
    • collectord.io/prometheus.{N}-username - basic auth username
    • collectord.io/prometheus.{N}-password - basic auth password
    • collectord.io/prometheus.{N}-whitelist - whitelist regexp
    • collectord.io/prometheus.{N}-blacklist - blacklist regexp
    • collectord.io/prometheus.{N}-authorizationkey - include Authorization header with the value specified in the ConfigMap under [input.prometheus_auto]
    • collectord.io/prometheus.{N}-caname - is used to verify the hostname on the returned certificates unless insecure is set
    • collectord.io/prometheus.{N}-output - specify output
    • collectord.io/prometheus.{N}-indexType - specify the index type for the metrics (default is events), you can change it to metrics