229 # The general configuration is used for all deployments
230 #
231 # Run collectord with the flag -conf and specify location of the configuration files.
232 #
233 # You can override all the values using environment variables with the format like
234 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
235 # As an example you can set dataPath in [general] section as
236 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
237 # This parameter can be configured using -env-override, set it to empty string to disable this feature
238
239 [general]
240
241 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
242 # and accept license by changing the value to *true*
243 acceptLicense = false
244
245 # Location for the database
246 # Collectord stores positions of the files and internal state
247 dataPath = ./data/
248
249 # log level (accepted values are trace, debug, info, warn, error, fatal)
250 logLevel = info
251
252 # Internal http server - serves the liveness (/healthz) and readiness (/readyz)
253 # probes. DaemonSets run on the host network, so bind to loopback (127.0.0.1:11888)
254 # to keep the endpoints off the node IP; the kubelet still reaches them via
255 # httpGet.host 127.0.0.1. The addon runs off the host network and overrides the
256 # bind to 0.0.0.0 in 004-addon.conf so the kubelet can reach it on the pod IP.
257 # httpServerBinding = 0.0.0.0:11888
258 httpServerBinding = 127.0.0.1:11888
259 httpServerEndpoints.health = true
260 httpServerEndpoints.ready = true
261 httpServerEndpoints.metrics = false
262 httpServerEndpoints.pprof = false
263
264 httpServerLog = false
265
266 # telemetry report endpoint, set it to empty string to disable telemetry
267 telemetryEndpoint = https://license.outcold.solutions/telemetry/
268
269 licenseEndpoint = https://license.outcold.solutions/license/
270
271 # Only for the Outcold Solutions License Server; one on-premises uses [license.client]
272 licenseServerProxyUrl =
273
274 # user:password
275 licenseServerProxyBasicAuth =
276
277 license =
278
279 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
280 # Use value below to override specific name
281 hostname =
282
283 # Default output for events, logs and metrics
284 # valid values: splunk and devnull
285 # Use devnull by default if you don't want to redirect data
286 defaultOutput = splunk
287
288 # The index type of every input that sets no indexType: events, metrics (a Splunk metrics
289 # index; set [output.splunk] defaultMetricsIndex) or both, to compare the dashboards
290 defaultIndexType = events
291
292 fileInputBufferSize = 8kb
293
294 fileInputLineMaxSize = 1mb
295
296 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
297 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
298 # Better way to configure that is to specify labels for Kubernetes Nodes.
299 # ; fields.my_environment = dev
300 # Identify the cluster if you are planning to monitor multiple clusters
301 fields.kubernetes_cluster = -
302
303 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
304 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
305 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
306 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
307
308 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
309 annotationsSubdomain =
310
311 # configure global thruput per second for forwarded logs (metrics are not included)
312 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
313 # from the single Collectord instance to 512Kb per second.
314 # You can configure thruput individually for the logs (including specific for container logs) below
315 thruputPerSecond =
316
317 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
318 # older than 7 days
319 tooOldEvents =
320
321 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
322 tooNewEvents =
323
324 # How Collectord spells the fields it composes: "_" (kubernetes_pod_name, the default) or "."
325 fieldsSeparator =
326
327 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
328 # detect gzipped files and skip them (based on the extensions or magic numbers)
329 autoSkipGzipFiles = true
330
331 # Publish to non-default outputs asynchronously (default), so a slow or down output does not
332 # block the others; false holds the pipeline back instead of dropping events.
333 multioutput.async = true
334
335 # Buffer size for the async proxy (default 100), per output of each pipeline. When it and
336 # the output's queue are full, events are dropped (multioutput_dropped_events).
337 multioutput.asyncBufferSize = 100
338
339 [license.client]
340 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
341 url =
342 basicAuth =
343 insecure = false
344 capath =
345 caname =
346 proxyUrl =
347
348 # user:password
349 proxyBasicAuth =
350
351 [input.collectord_metrics]
352
353 disabled = false
354
355 type = kubernetes_prometheus
356
357 interval = 1m
358
359 output =
360
361 index =
362
363 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
364 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
365 # metricsOutput: an output whose HEC token can write to the metrics index.
366 metricsIndex =
367 metricsOutput =
368
369 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
370 whitelist.1 = ^file_input_open$
371 whitelist.2 = ^file_input_read_bytes$
372 whitelist.3 = ^kubernetes_handlers$
373 whitelist.4 = ^pipe$
374 whitelist.5 = ^pipelines_num$
375 whitelist.6 = ^splunk_post_bytes_sum.*$
376 whitelist.7 = ^splunk_post_events_count_sum.*$
377 whitelist.8 = ^splunk_post_failed_requests$
378 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
379 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
380 whitelist.11 = ^splunk_post_retries_required_sum.*$
381
382 [general.kubernetes]
383
384 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
385 serviceURL =
386
387 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
388 # Use it only when you need to override it
389 nodeName =
390
391 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
392 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
393
394 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
395 timeout = 30m
396
397 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
398 metadataTTL = 30s
399
400 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
401
402 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
403
404 # path to the kubelet root location (use it to discover application logs for emptyDir)
405 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
406 volumesRootDir = /rootfs/var/lib/kubelet/
407
408 # You can attach annotations as a metadata, using the format
409 # includeAnnotations.{key} = {regexp}
410 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
411 # the following format:
412 # includeAnnotations.1 = ^prometheus\.io.*
413 # includeAnnotations.2 = ^example\.com.*
414
415 # You can exclude labels from metadata, using the format
416 # excludeLabels.{key} = {regexp}
417 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
418 # the following format:
419 # excludeLabels.1 = ^prometheus\.io.*
420 # excludeLabels.2 = ^example\.com.*
421
422 # watch for changes (annotations) in the objects
423 watch.namespace = v1/namespace
424 watch.deployment = apps/v1/deployment
425 watch.configuration = collectord.io/v1/configuration
426
427 # true lets an annotation name a SplunkOutput of another namespace (splunk::user/<namespace>/<name>),
428 # sending the annotated pod's data with that namespace's HEC token into its indexes
429 crossNamespaceUserOutputs = false
430
431 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
432 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
433 # This way Collectord does not generate 403 requests on API Server
434 clusterRole = collectorforkubernetes
435
436 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
437 # You can define which objects Collectord should traverse when it sees Owners.
438 ; traverseOwnership.namespaces = v1/namespace
439
440 # watch for pods annotations, setup prometheus collection
441 # for these pods
442 # Addon listens on Pod Network
443 # DaemonSets listen on Host Network
444 [input.prometheus_auto]
445
446 disabled = false
447
448 type = kubernetes_prometheus
449
450 index =
451
452 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
453 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
454 # metricsOutput: an output whose HEC token can write to the metrics index.
455 metricsIndex =
456 metricsOutput =
457
458 interval = 60s
459
460 includeHelp = true
461
462 timeout = 30s
463
464 output =
465
466 # Include an Authorization header for the prometheus scrapper
467 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
468 # authorization.key1 = Bearer FOO
469
470 [output.splunk]
471
472 url =
473
474 # Specify how URL should be picked up (in case if multiple is used)
475 # urlSelection = random|round-robin|random-with-round-robin
476 # where:
477 # * random - choose random url on first selection and a different random one after each failure (connection or HTTP status code >= 500)
478 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
479 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
480 # failure (connection or HTTP status code >= 500)
481 # With round-robin and random-with-round-robin, the instances on a failed url can all move to the same next one.
482 urlSelection = random
483 token =
484 insecure = false
485 caPath =
486 caName =
487 clientCertPath =
488 clientKeyPath =
489
490 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
491 # than set by frequency
492 frequency = 5s
493 batchSize = 768K
494
495 # limit by the number of events (0 value has no limit on the number of events)
496 events = 50
497 proxyUrl =
498
499 # user:password
500 proxyBasicAuth =
501
502 # Splunk acknowledgement url (.../services/collector/ack)
503 ackUrl =
504 ackEnabled = false
505 ackTimeout = 3m
506
507 # Timeout specifies a time limit for requests made by collectord.
508 # The timeout includes connection time, any
509 # redirects, and reading the response body.
510 timeout = 30s
511 idleConnTimeout = 5m
512
513 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
514 # all pipelines, because just some events have incorrect index
515 dedicatedClientPerIndex = true
516
517 # possible values: RedirectToDefault, Drop, Retry
518 incorrectIndexBehavior = RedirectToDefault
519
520 # gzip compression level (nocompression, default, 1...9)
521 compressionLevel = default
522
523 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
524 threads = 2
525
526 # Default algorithm between threads is roundrobin, but you can change it to weighted
527 ; threadsAlgorithm = weighted
528 threadsAlgorithm = weighted
529
530 # For the move to fieldsSeparator = ".": send every built-in field a second time under its
531 # underscore name (events only). A named output inherits the default output's value.
532 ; duplicateFieldsWithUnderscore = true
533 duplicateFieldsWithUnderscore = false
534
535 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
536 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
537 # to ignore all events that don't have index defined explicitly
538 ; requireExplicitIndex = true
539 requireExplicitIndex = false
540
541 # Splunk metrics index for the metrics-index records (indexType = metrics or both) of every
542 # input that names no metricsIndex; unset, they land in the HEC token's default index
543 ; defaultMetricsIndex = kubernetes_metrics
544 defaultMetricsIndex =
545
546 # For messages generated from logs, include unique `event_id` in the event
547 ; includeEventID = false
548 includeEventID = false
549
550 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
551 # but will allow to handle more events in case of network issues
552 queueSize = 1024
554 [general.cri-o]
555
556 # url for CRIO API, only unix socket is supported
557 url = unix:///rootfs/var/run/crio/crio.sock
558
559 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
560 timeout = 1m
561
562 [general.containerd]
563 # Runtime can be on /rootfs/run/containerd (depends on the Linux distribution)
564 runtimePath = /rootfs/var/run/containerd
565 namespace = k8s.io
566
567 [input.system_stats]
568
569 disabled.host = false
570 disabled.cgroup = false
571
572 pathCgroups = /rootfs/sys/fs/cgroup
573
574 pathProc = /rootfs/proc
575
576 statsInterval = 30s
577
578 type.host = kubernetes_stats_v2_host
579 type.cgroup = kubernetes_stats_v2_cgroup
580
581 index.host =
582 index.cgroup =
583
584 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
585 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
586 # metricsOutput: an output whose HEC token can write to the metrics index.
587 metricsIndex.host =
588 metricsIndex.cgroup =
589 metricsOutput.host =
590 metricsOutput.cgroup =
591
592 output.host =
593 output.cgroup =
594
595 [input.proc_stats]
596
597 disabled = false
598
599 pathProc = /rootfs/proc
600
601 statsInterval = 30s
602
603 type = kubernetes_proc_stats_v2
604
605 index.host =
606 index.cgroup =
607
608 # proc filesystem includes by default system threads (there can be over 100 of them)
609 # these stats do not help with the observability
610 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
611 includeSystemThreads = false
612
613 output.host =
614 output.cgroup =
615
616 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
617 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
618 # metricsOutput: an output whose HEC token can write to the metrics index.
619 metricsIndex =
620 metricsOutput =
621
622 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
623 hideArgs = false
624
625 [input.net_stats]
626
627 disabled = false
628
629 pathProc = /rootfs/proc
630
631 statsInterval = 30s
632
633 type = kubernetes_net_stats_v2
634
635 index.host =
636 index.cgroup =
637
638 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
639 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
640 # metricsOutput: an output whose HEC token can write to the metrics index.
641 metricsIndex.host =
642 metricsIndex.cgroup =
643 metricsOutput.host =
644 metricsOutput.cgroup =
645
646 output.host =
647 output.cgroup =
648
649 [input.net_socket_table]
650
651 disabled = false
652
653 pathProc = /rootfs/proc
654
655 statsInterval = 30s
656
657 type = kubernetes_net_socket_table
658
659 index.host =
660 index.cgroup =
661
662 output.host =
663 output.cgroup =
664
665 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
666 # that can significally reduces the amount of events
667 group = true
668
669 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
670 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
671 disableLookup = false
672
673 [input.mount_stats]
674
675 disabled = false
676
677 statsInterval = 30s
678
679 # root: the filesystem of the kubelet's root directory; auto: every real filesystem, one event each
680 mounts = root
681
682 # with mounts = auto: a regular expression the filesystem type must match, and one the
683 # mount point must not (empty: the defaults)
684 include =
685 exclude =
686
687 type = kubernetes_mount_stats
688
689 index =
690
691 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
692 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
693 # metricsOutput: an output whose HEC token can write to the metrics index.
694 metricsIndex =
695 metricsOutput =
696
697 output =
698
699 [input.disk_stats]
700
701 disabled = false
702
703 statsInterval = 30s
704
705 type = kubernetes_disk_stats
706
707 index =
708
709 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
710 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
711 # metricsOutput: an output whose HEC token can write to the metrics index.
712 metricsIndex =
713 metricsOutput =
714
715 output =
716
717 [input.files]
718
719 disabled = false
720
721 # root location of docker log files
722 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
723 # rotated files
724 path = /rootfs/var/lib/docker/containers/
725
726 # root location of CRI-O files
727 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
728 crioPath = /rootfs/var/log/pods/
729
730 # files are read using polling schema, when reach the EOF how often to check if files got updated
731 pollingInterval = 250ms
732
733 # how often to look for the new files under logs path
734 walkingInterval = 5s
735
736 # include verbose fields in events (file offset)
737 verboseFields = false
738
739 type = kubernetes_logs
740
741 index =
742
743 # docker splits events when they are larger than 10-100k (depends on the docker version)
744 # we join them together by default and forward to Splunk as one event
745 joinPartialEvents = true
746
747 # In case if your containers report messages with terminal colors or other escape sequences
748 # you can enable strip for all the containers in one place.
749 # Better is to enable it only for required container with the annotation collectord.io/logs-escapeterminalsequences=true
750 stripTerminalEscapeSequences = false
751
752 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
753 # Read http://man7.org/linux/man-pages/man4/console_codes.4.html for more information
754 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
755
756 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
757 samplingPercent = -1
758
759 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
760 samplingKey =
761
762 output =
763
764 # configure default thruput per second for for each container log
765 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
766 # from the single container to 128Kb per second.
767 thruputPerSecond =
768
769 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
770 # older than 7 days
771 tooOldEvents =
772
773 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
774 tooNewEvents =
775
776 # Read rotated logs the kubelet compressed before Collectord read them; false counts them lost
777 readCompressed = true
778
779 # Bytes of those logs inflated at once, node-wide, under [general] dataPath
780 compressedInflateBudget = 256MiB
781
782 # Group each stream's repeated lines into one event per run that counts them.
783 # Off unless true; a workload overrides it with its
784 # collectord.io/logs-repeat-enabled annotation.
785 repeatEnabled = false
786
787 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
788 # repeatMaxSpan = 1m
789
790 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
791 # repeatOffsets = false
792
793 # What each stream may remember: distinct lines, lines one event stands for, and bytes
794 # repeatMaxKeys = 256
795 # repeatMaxCount = 1000
796 # repeatMaxBytes = 256KB
797
798 # Fold each stream's lines of one pattern past foldMaxPerMinute into one summary a minute.
799 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
800 # collectord.io/logs-fold-enabled annotation.
801 foldEnabled = false
802
803 # Lines of one pattern a minute sent before the rest fold
804 # foldMaxPerMinute = 60
805
806 # Lines never folded (a regular expression; empty: the default)
807 # foldKeep = (?i)error|exception|fatal|panic
808
809 # What each stream may keep a minute: its patterns and summaries
810 # foldMaxBytes = 256KB
811
812 # Report each stream's top patterns every interval, as events of their own.
813 # Off unless true; a workload overrides it with its
814 # collectord.io/logs-patterns-enabled annotation.
815 patternsEnabled = false
816
817 # How often a report goes out, from 1m to 24h
818 # patternsInterval = 15m
819
820 # How many patterns a report carries, up to 100
821 # patternsTop = 20
822
823 # What each stream's patterns may keep; past it a new one takes the place of the lightest
824 # patternsMaxBytes = 256KB
825
826 # The report events' type (empty: the input's type with _patterns after it)
827 # patternsType =
828
829 [input.app_logs]
830
831 disabled = false
832
833 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
834 root = /rootfs/
835
836 # how often to review list of available volumes
837 syncInterval = 5s
838
839 glob = *.log*
840
841 # files are read using polling schema, when reach the EOF how often to check if files got updated
842 pollingInterval = 250ms
843
844 # how often to look for the new files under logs path
845 walkingInterval = 5s
846
847 # include verbose fields in events (file offset)
848 verboseFields = false
849
850 type = kubernetes_logs
851
852 index =
853
854 # we split files using new line character, with this configuration you can specify what defines the new event
855 # after new line
856 eventPatternRegex = ^[^\s]
857 eventPatternMaxInterval = 100ms
858 eventPatternMaxWait = 1s
859 eventPatternMaxSize = 1MB
860
861 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
862 samplingPercent = -1
863
864 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
865 samplingKey =
866
867 output =
868
869 # configure default thruput per second for for each container log
870 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
871 # from the single container to 128Kb per second.
872 thruputPerSecond =
873
874 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
875 # older than 7 days
876 tooOldEvents =
877
878 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
879 tooNewEvents =
880
881 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
882 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
883 # of pods, as kubelet cannot unmount the PVC volume from the system
884 maxHoldAfterClose = 1800s
885
886 # Group each file's repeated lines into one event per run that counts them.
887 # Off unless true; a workload overrides it with its
888 # collectord.io/volume.<n>-logs-repeat-enabled annotation.
889 repeatEnabled = false
890
891 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
892 # repeatMaxSpan = 1m
893
894 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
895 # repeatOffsets = false
896
897 # What each file may remember: distinct lines, lines one event stands for, and bytes
898 # repeatMaxKeys = 256
899 # repeatMaxCount = 1000
900 # repeatMaxBytes = 256KB
901
902 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
903 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
904 # collectord.io/volume.<n>-logs-fold-enabled annotation.
905 foldEnabled = false
906
907 # Lines of one pattern a minute sent before the rest fold
908 # foldMaxPerMinute = 60
909
910 # Lines never folded (a regular expression; empty: the default)
911 # foldKeep = (?i)error|exception|fatal|panic
912
913 # What each file may keep a minute: its patterns and summaries
914 # foldMaxBytes = 256KB
915
916 # Report each file's top patterns every interval, as events of their own.
917 # Off unless true; a workload overrides it with its
918 # collectord.io/volume.<n>-logs-patterns-enabled annotation.
919 patternsEnabled = false
920
921 # How often a report goes out, from 1m to 24h
922 # patternsInterval = 15m
923
924 # How many patterns a report carries, up to 100
925 # patternsTop = 20
926
927 # What each file's patterns may keep; past it a new one takes the place of the lightest
928 # patternsMaxBytes = 256KB
929
930 # The report events' type (empty: the input's type with _patterns after it)
931 # patternsType =
932
933 [input.files::audit-logs]
934
935 disabled = false
936
937 path = /rootfs/var/log/kube-apiserver/
938
939 glob = audit*.log
940
941 match =
942
943 # limit search only on one level
944 recursive = false
945 nodeSelector = node-role.kubernetes.io/control-plane
946
947 # files are read using polling schema, when reach the EOF how often to check if files got updated
948 pollingInterval = 250ms
949
950 # how often o look for the new files under logs path
951 walkingInterval = 5s
952
953 # include verbose fields in events (file offset)
954 verboseFields = false
955
956 type = kubernetes_host_logs
957
958 index =
959
960 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
961 extractionMessageField = message
962
963 timestampField = timestamp
964
965 # format for timestamp
966 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
967 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
968
969 # timestamp location (if not defined by format)
970 timestampLocation =
971
972 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
973 samplingPercent = -1
974
975 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
976 samplingKey =
977
978 output =
979
980 # configure default thruput per second for this files group
981 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
982 # from the files in this group to 128Kb per second.
983 thruputPerSecond =
984
985 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
986 # older than 7 days
987 tooOldEvents =
988
989 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
990 tooNewEvents =
991
992 # by default every new event should start from not space symbol
993 eventPattern =
994
995 # Blacklisting and whitelisting the logs
996 # whitelist.0 = ^regexp$
997 # blacklist.0 = ^regexp$
998
999 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1000 # a spent cap drops the other lines instead of pausing this input
1001 # thruputExempt.0 = ^regexp$
1002
1003 # Group each file's repeated lines into one event per run that counts them.
1004 # Off unless true.
1005 repeatEnabled = false
1006
1007 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1008 # repeatMaxSpan = 1m
1009
1010 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1011 # repeatOffsets = false
1012
1013 # What each file may remember: distinct lines, lines one event stands for, and bytes
1014 # repeatMaxKeys = 256
1015 # repeatMaxCount = 1000
1016 # repeatMaxBytes = 256KB
1017
1018 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1019 # Lossy: folded lines are not sent. Off unless true.
1020 foldEnabled = false
1021
1022 # Lines of one pattern a minute sent before the rest fold
1023 # foldMaxPerMinute = 60
1024
1025 # Lines never folded (a regular expression; empty: the default)
1026 # foldKeep = (?i)error|exception|fatal|panic
1027
1028 # What each file may keep a minute: its patterns and summaries
1029 # foldMaxBytes = 256KB
1030
1031 # Report each file's top patterns every interval, as events of their own.
1032 # Off unless true.
1033 patternsEnabled = false
1034
1035 # How often a report goes out, from 1m to 24h
1036 # patternsInterval = 15m
1037
1038 # How many patterns a report carries, up to 100
1039 # patternsTop = 20
1040
1041 # What each file's patterns may keep; past it a new one takes the place of the lightest
1042 # patternsMaxBytes = 256KB
1043
1044 # The report events' type (empty: the input's type with _patterns after it)
1045 # patternsType =
1046
1047 [input.files::logs]
1048
1049 disabled = false
1050
1051 path = /rootfs/var/log/
1052
1053 glob =
1054
1055 match = ^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$
1056 exclude = ^(auth|cron|daemon|kern|lpr|mail|user|ufw)\.log(.[\d\-]+)?$
1057
1058 # limit search only on one level
1059 recursive = false
1060
1061 # files are read using polling schema, when reach the EOF how often to check if files got updated
1062 pollingInterval = 250ms
1063
1064 # how often o look for the new files under logs path
1065 walkingInterval = 5s
1066
1067 # include verbose fields in events (file offset)
1068 verboseFields = false
1069
1070 type = kubernetes_host_logs
1071
1072 index =
1073
1074 extraction =
1075 extractionMessageField =
1076
1077 timestampField =
1078
1079 # format for timestamp
1080 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1081 timestampFormat =
1082
1083 # Adjust date, if month/day aren't set in format
1084 timestampSetMonth = false
1085 timestampSetDay = false
1086
1087 # timestamp location (if not defined by format)
1088 timestampLocation =
1089
1090 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1091 samplingPercent = -1
1092
1093 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1094 samplingKey =
1095
1096 output =
1097
1098 # configure default thruput per second for this files group
1099 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1100 # from the files in this group to 128Kb per second.
1101 thruputPerSecond =
1102
1103 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1104 # older than 7 days
1105 tooOldEvents =
1106
1107 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1108 tooNewEvents =
1109
1110 # by default every new event should start from not space symbol
1111 eventPattern = ^[^\s]
1112
1113 # Blacklisting and whitelisting the logs
1114 # whitelist.0 = ^regexp$
1115 # blacklist.0 = ^regexp$
1116
1117 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1118 # a spent cap drops the other lines instead of pausing this input
1119 # thruputExempt.0 = ^regexp$
1120
1121 # Group each file's repeated lines into one event per run that counts them.
1122 # Off unless true.
1123 repeatEnabled = false
1124
1125 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1126 # repeatMaxSpan = 1m
1127
1128 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1129 # repeatOffsets = false
1130
1131 # What each file may remember: distinct lines, lines one event stands for, and bytes
1132 # repeatMaxKeys = 256
1133 # repeatMaxCount = 1000
1134 # repeatMaxBytes = 256KB
1135
1136 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1137 # Lossy: folded lines are not sent. Off unless true.
1138 foldEnabled = false
1139
1140 # Lines of one pattern a minute sent before the rest fold
1141 # foldMaxPerMinute = 60
1142
1143 # Lines never folded (a regular expression; empty: the default)
1144 # foldKeep = (?i)error|exception|fatal|panic
1145
1146 # What each file may keep a minute: its patterns and summaries
1147 # foldMaxBytes = 256KB
1148
1149 # Report each file's top patterns every interval, as events of their own.
1150 # Off unless true.
1151 patternsEnabled = false
1152
1153 # How often a report goes out, from 1m to 24h
1154 # patternsInterval = 15m
1155
1156 # How many patterns a report carries, up to 100
1157 # patternsTop = 20
1158
1159 # What each file's patterns may keep; past it a new one takes the place of the lightest
1160 # patternsMaxBytes = 256KB
1161
1162 # The report events' type (empty: the input's type with _patterns after it)
1163 # patternsType =
1164
1165 [input.files::syslog]
1166
1167 disabled = true
1168
1169 path = /rootfs/var/log/
1170
1171 glob =
1172
1173 match = ^(syslog|messages|auth\.log)(.[\d\-]+)?$
1174
1175 # limit search only on one level
1176 recursive = false
1177
1178 # files are read using polling schema, when reach the EOF how often to check if files got updated
1179 pollingInterval = 250ms
1180
1181 # how often o look for the new files under logs path
1182 walkingInterval = 5s
1183
1184 # include verbose fields in events (file offset)
1185 verboseFields = false
1186
1187 type = kubernetes_host_logs
1188
1189 index =
1190
1191 extraction = ^(?P<timestamp>[A-Za-z]+\s+\d+\s\d+:\d+:\d+|\d{4}-\d{2}-\d{2}T\S+)\s(?P<syslog_hostname>[^\s]+)\s(?P<syslog_component>[^:\[]+)(\[(?P<syslog_pid>\d+)\])?: (.+)$
1192 extractionMessageField =
1193
1194 # the extracted fields naming the process that wrote a line, which groups its lines apart
1195 extractionWriterFields = syslog_hostname, syslog_component, syslog_pid
1196
1197 timestampField = timestamp
1198
1199 # format for timestamp
1200 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1201 timestampFormat = @syslog
1202
1203 # Adjust date, if month/day aren't set in format
1204 timestampSetMonth = false
1205 timestampSetDay = false
1206
1207 # timestamp location (if not defined by format)
1208 timestampLocation = Local
1209
1210 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1211 samplingPercent = -1
1212
1213 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1214 samplingKey =
1215
1216 output =
1217
1218 # configure default thruput per second for this files group
1219 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1220 # from the files in this group to 128Kb per second.
1221 thruputPerSecond =
1222
1223 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1224 # older than 7 days
1225 tooOldEvents =
1226
1227 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1228 tooNewEvents =
1229
1230 # by default every new event should start from not space symbol
1231 eventPattern = ^[^\s]
1232
1233 # Blacklisting and whitelisting the logs
1234 # whitelist.0 = ^regexp$
1235 # blacklist.0 = ^regexp$
1236
1237 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1238 # a spent cap drops the other lines instead of pausing this input
1239 # thruputExempt.0 = ^regexp$
1240
1241 # Group each file's repeated lines into one event per run that counts them.
1242 # Off unless true.
1243 repeatEnabled = false
1244
1245 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1246 # repeatMaxSpan = 1m
1247
1248 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1249 # repeatOffsets = false
1250
1251 # What each file may remember: distinct lines, lines one event stands for, and bytes
1252 # repeatMaxKeys = 256
1253 # repeatMaxCount = 1000
1254 # repeatMaxBytes = 256KB
1255
1256 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1257 # Lossy: folded lines are not sent. Off unless true.
1258 foldEnabled = false
1259
1260 # Lines of one pattern a minute sent before the rest fold
1261 # foldMaxPerMinute = 60
1262
1263 # Lines never folded (a regular expression; empty: the default)
1264 # foldKeep = (?i)error|exception|fatal|panic
1265
1266 # What each file may keep a minute: its patterns and summaries
1267 # foldMaxBytes = 256KB
1268
1269 # Report each file's top patterns every interval, as events of their own.
1270 # Off unless true.
1271 patternsEnabled = false
1272
1273 # How often a report goes out, from 1m to 24h
1274 # patternsInterval = 15m
1275
1276 # How many patterns a report carries, up to 100
1277 # patternsTop = 20
1278
1279 # What each file's patterns may keep; past it a new one takes the place of the lightest
1280 # patternsMaxBytes = 256KB
1281
1282 # The report events' type (empty: the input's type with _patterns after it)
1283 # patternsType =
1284
1285 [input.journald]
1286
1287 disabled = false
1288
1289 path.persistent = /rootfs/var/log/journal/
1290 path.volatile = /rootfs/run/log/journal/
1291
1292 # when reach end of journald, how often to pull
1293 pollingInterval = 250ms
1294
1295 # if you don't want to forward journald from the beginning,
1296 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1297 startFromRel =
1298
1299 type = kubernetes_host_logs
1300
1301 index =
1302
1303 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1304 samplingPercent = -1
1305
1306 # sampling key (should be regexp with the named match pattern `key`)
1307 samplingKey =
1308
1309 # how often to reopen the journald to free old files
1310 reopenInterval = 1h
1311
1312 output =
1313
1314 # configure default thruput per second for journald
1315 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1316 # from the journald to 128Kb per second.
1317 thruputPerSecond =
1318
1319 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1320 # older than 7 days
1321 tooOldEvents =
1322
1323 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1324 tooNewEvents =
1325
1326 # by default every new event should start from not space symbol
1327 eventPattern = ^[^\s]
1328
1329 # By default ignoring verbose hyperkube logs (all INFO messages)
1330
1331 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1332 # a spent cap drops the other lines instead of pausing journald
1333
1334 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1335 spawnExternalProcess = false
1336
1337 # Group each writer's repeated lines into one event per run that counts them.
1338 # Off unless true.
1339 # A writer is a unit, identifier, command, process, priority and facility: never grouped with another.
1340 repeatEnabled = false
1341
1342 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1343 # repeatMaxSpan = 1m
1344
1345 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1346 # repeatOffsets = false
1347
1348 # What the journal, all its writers together, may remember: distinct lines, lines one event stands for, and bytes
1349 # repeatMaxKeys = 256
1350 # repeatMaxCount = 1000
1351 # repeatMaxBytes = 256KB
1352
1353 # Fold each writer's lines of one pattern past foldMaxPerMinute into one summary a minute.
1354 # Lossy: folded lines are not sent. Off unless true.
1355 # A writer is a unit, identifier, command, process, priority and facility: never folded with another.
1356 foldEnabled = false
1357
1358 # Lines of one pattern a minute sent before the rest fold
1359 # foldMaxPerMinute = 60
1360
1361 # Lines never folded (a regular expression; empty: the default)
1362 # foldKeep = (?i)error|exception|fatal|panic
1363
1364 # What the journal, all its writers together, may keep a minute: its patterns and summaries
1365 # foldMaxBytes = 256KB
1366
1367 # Report the journal's top patterns every interval, as events of their own.
1368 # Off unless true.
1369 # A writer is a unit, identifier, command, process, priority and facility: its lines never share a pattern with another's, and the top patterns are of all its writers together.
1370 patternsEnabled = false
1371
1372 # How often a report goes out, from 1m to 24h
1373 # patternsInterval = 15m
1374
1375 # How many patterns a report carries, up to 100
1376 # patternsTop = 20
1377
1378 # What the journal's patterns may keep; past it a new one takes the place of the lightest
1379 # patternsMaxBytes = 256KB
1380
1381 # The report events' type (empty: the input's type with _patterns after it)
1382 # patternsType =
1383
1384 # Pipe to join events (container logs only)
1385 [pipe.join]
1386
1387 disabled = false
1388
1389 maxInterval = 100ms
1390
1391 maxWait = 1s
1392
1393 maxSize = 1MB
1394
1395 # Default pattern to indicate new message (should start not from space)
1396 patternRegex = ^[^\s]
1397
1398 # You can configure global replace rules for the events, which can help to remove sensitive data
1399 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1400 # application logs and events.
1401 # In the following example we replace password=TEST with password=********
1402 ; [pipe.replace::name]
1403 ; patternRegex = (password=)([^\s]+)
1404 ; replace = $1********
1405
1406 # You can configure global hash rules for the events, which can help to hide sensitive data
1407 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1408 # application logs and events.
1409 # In the following example we hash IP addresses with fnv-1a-64
1410 ; [pipe.hash::name]
1411 ; match = (\d{1,3}\.){3}\d{1,3}'
1412 ; function = fnv-1a-64
1413
1414 # Log lines matching patternRegex pass every thruput cap and sampling, in the workloads whose
1415 # fields match every matchRegex.<field>; over its cap such a workload drops its other lines
1416 # instead of pausing. Select by namespace: pod, container and image names are the workload
1417 # owner's to choose, and label fields never match
1418 ; [pipe.thruput_exempt::payments-audit]
1419 ; matchRegex.kubernetes_namespace = ^payments$
1420 ; patternRegex = ^AUDIT
1421
1422 # Count the events and bytes leaving every pipeline (pipeline_events, pipeline_bytes);
1423 # maxSeries bounds the label combinations. Fields are written with underscores.
1424 ; [pipe.eventcount]
1425 ; labels = index, sourcetype, output
1426 ; fields = kubernetes_namespace
1427 ; maxSeries = 1000
1428
1429 [input.prometheus::controller-manager]
1430
1431 disabled = false
1432
1433 type = kubernetes_prometheus
1434
1435 index =
1436
1437 source = controller-manager
1438
1439 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1440 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1441 # metricsOutput: an output whose HEC token can write to the metrics index.
1442 metricsIndex =
1443 metricsOutput =
1444
1445 # Override host (environment variables are supported)
1446 host = ${KUBERNETES_NODENAME}
1447
1448 source = controller-manager
1449
1450 interval = 60s
1451
1452 timeout = 60s
1453
1454 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1455 # podSelector (with podNamespace): the pods on this node a label selector matches;
1456 # endpoint(s) beside it are the fallback on a node where none runs.
1457 podNamespace = kube-system
1458 podSelector = component=kube-controller-manager
1459 podSelector.kops = k8s-app=kube-controller-manager
1460
1461 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1462
1463 # endpoint.N: literal URLs, the first that answers
1464
1465 endpoint.1 = https://127.0.0.1:10257/metrics
1466
1467 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1468 nodeSelector = node-role.kubernetes.io/control-plane
1469
1470 # === HOW: port (number) or portName, plus scheme and path ===
1471 port = 10257
1472
1473 scheme = https
1474 path = /metrics
1475
1476 # token for "Authorization: Bearer $(cat tokenPath)"
1477 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1478
1479 # server certificate for certificate validation
1480 certPath =
1481
1482 clientCertPath =
1483
1484 insecure = true
1485
1486 includeHelp = false
1487
1488 output =
1489
1490 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1491
1492 whitelist.1 = ^kubernetes_build_info$
1493 whitelist.2 = ^node_collector_zone_size$
1494 whitelist.3 = ^node_collector_zone_health$
1495 whitelist.4 = ^node_collector_unhealthy_nodes_in_zone$
1496 whitelist.5 = ^node_collector_evictions_total$
1497 whitelist.6 = ^workqueue_depth$
1498 whitelist.7 = ^workqueue_retries_total$
1499 whitelist.8 = ^workqueue_longest_running_processor_seconds$
1500 whitelist.9 = ^leader_election_master_status$
1501 whitelist.10 = ^rest_client_requests_total$
1502 whitelist.11 = ^rest_client_request_duration_seconds_sum$
1503 whitelist.12 = ^process_cpu_seconds_total$
1504 whitelist.13 = ^process_resident_memory_bytes$
1505 whitelist.14 = ^process_virtual_memory_bytes$
1506 whitelist.15 = ^process_open_fds$
1507 whitelist.16 = ^process_max_fds$
1508 whitelist.17 = ^go_goroutines$
1509 whitelist.18 = ^process_start_time_seconds$
1510
1511 [input.prometheus::coredns]
1512
1513 disabled = false
1514
1515 type = kubernetes_prometheus
1516
1517 index =
1518
1519 source = coredns
1520
1521 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1522 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1523 # metricsOutput: an output whose HEC token can write to the metrics index.
1524 metricsIndex =
1525 metricsOutput =
1526
1527 # Override host (environment variables are supported)
1528 host = ${KUBERNETES_NODENAME}
1529
1530 source = coredns
1531
1532 interval = 60s
1533
1534 timeout = 60s
1535
1536 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1537 # podSelector (with podNamespace): the pods on this node a label selector matches;
1538 # endpoint(s) beside it are the fallback on a node where none runs.
1539 podNamespace = kube-system
1540 podSelector = k8s-app in (kube-dns,coredns)
1541
1542 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1543
1544 # endpoint.N: literal URLs, the first that answers
1545
1546 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1547
1548 # === HOW: port (number) or portName, plus scheme and path ===
1549 port = 9153
1550
1551 portDeclared = true
1552 scheme = http
1553 path = /metrics
1554
1555 # token for "Authorization: Bearer $(cat tokenPath)"
1556 tokenPath =
1557
1558 # server certificate for certificate validation
1559 certPath =
1560
1561 clientCertPath =
1562
1563 insecure = false
1564
1565 includeHelp = false
1566
1567 output =
1568
1569 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1570
1571 whitelist.1 = ^coredns_.+$
1572 whitelist.2 = ^go_gc_duration_seconds$
1573 whitelist.3 = ^go_goroutines$
1574 whitelist.4 = ^go_memstats_heap_inuse_bytes$
1575 whitelist.5 = ^process_cpu_seconds_total$
1576 whitelist.6 = ^process_network_receive_bytes_total$
1577 whitelist.7 = ^process_network_transmit_bytes_total$
1578 whitelist.8 = ^process_open_fds$
1579 whitelist.9 = ^process_resident_memory_bytes$
1580 whitelist.10 = ^process_start_time_seconds$
1581 whitelist.11 = ^process_virtual_memory_bytes$
1582
1583 [input.prometheus::etcd]
1584
1585 disabled = false
1586
1587 type = kubernetes_prometheus
1588
1589 index =
1590
1591 source = etcd
1592
1593 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1594 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1595 # metricsOutput: an output whose HEC token can write to the metrics index.
1596 metricsIndex =
1597 metricsOutput =
1598
1599 # Override host (environment variables are supported)
1600 host = ${KUBERNETES_NODENAME}
1601
1602 source = etcd
1603
1604 interval = 60s
1605
1606 timeout = 60s
1607
1608 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1609 # podSelector (with podNamespace): the pods on this node a label selector matches;
1610 # endpoint(s) beside it are the fallback on a node where none runs.
1611 podNamespace = kube-system
1612 podSelector = component=etcd
1613
1614 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1615
1616 # endpoint.N: literal URLs, the first that answers
1617
1618 endpoint.1 = http://127.0.0.1:2381/metrics
1619
1620 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1621 nodeSelector = node-role.kubernetes.io/control-plane
1622
1623 # === HOW: port (number) or portName, plus scheme and path ===
1624 port = 2381
1625 portName = probe-port
1626 scheme = http
1627 path = /metrics
1628
1629 # token for "Authorization: Bearer $(cat tokenPath)"
1630 tokenPath =
1631
1632 # server certificate for certificate validation
1633 certPath =
1634
1635 clientCertPath =
1636
1637 insecure = false
1638
1639 includeHelp = false
1640
1641 output =
1642
1643 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1644
1645 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1646 whitelist.2 = ^etcd_server_has_leader$
1647 whitelist.3 = ^etcd_server_is_leader$
1648 whitelist.4 = ^etcd_server_proposals_committed_total$
1649 whitelist.5 = ^etcd_server_proposals_applied_total$
1650 whitelist.6 = ^etcd_server_proposals_pending$
1651 whitelist.7 = ^etcd_server_proposals_failed_total$
1652 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1653 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1654 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1655 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1656 whitelist.12 = ^etcd_network_client_grpc_.*$
1657 whitelist.13 = ^grpc_server_handled_total$
1658 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1659 whitelist.15 = ^etcd_network_peer_sent_failures_total$
1660 whitelist.16 = ^etcd_mvcc_db_total_size_in_bytes$
1661 whitelist.17 = ^etcd_mvcc_db_total_size_in_use_in_bytes$
1662 whitelist.18 = ^etcd_server_quota_backend_bytes$
1663 whitelist.19 = ^etcd_debugging_mvcc_keys_total$
1664 whitelist.20 = ^etcd_server_slow_apply_total$
1665 whitelist.21 = ^etcd_server_slow_read_indexes_total$
1666 whitelist.22 = ^etcd_server_read_indexes_failed_total$
1667 whitelist.23 = ^etcd_server_health_failures$
1668 whitelist.24 = ^process_cpu_seconds_total$
1669 whitelist.25 = ^process_resident_memory_bytes$
1670 whitelist.26 = ^process_virtual_memory_bytes$
1671 whitelist.27 = ^process_open_fds$
1672 whitelist.28 = ^process_max_fds$
1673 whitelist.29 = ^go_goroutines$
1674 whitelist.30 = ^process_start_time_seconds$
1675 whitelist.31 = ^etcd_server_version$
1676 whitelist.32 = ^etcd_cluster_version$
1677 whitelist.33 = ^etcd_server_go_version$
1678 whitelist.34 = ^etcd_server_id$
1679 whitelist.35 = ^etcd_network_peer_round_trip_time_seconds_sum$
1680
1681 # counters, by name, whose series are not sent until they first rise above 0
1682 skipZeroCounters.1 = ^grpc_server_handled_total$
1683
1684 [input.prometheus::kube-proxy]
1685
1686 disabled = false
1687
1688 type = kubernetes_prometheus
1689
1690 index =
1691
1692 source = kube-proxy
1693
1694 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1695 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1696 # metricsOutput: an output whose HEC token can write to the metrics index.
1697 metricsIndex =
1698 metricsOutput =
1699
1700 # Override host (environment variables are supported)
1701 host = ${KUBERNETES_NODENAME}
1702
1703 source = kube-proxy
1704
1705 interval = 60s
1706
1707 timeout = 60s
1708
1709 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1710 # podSelector (with podNamespace): the pods on this node a label selector matches;
1711 # endpoint(s) beside it are the fallback on a node where none runs.
1712
1713 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1714
1715 # endpoint.N: literal URLs, the first that answers
1716
1717 endpoint.1 = http://127.0.0.1:10249/metrics
1718
1719 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1720
1721 # === HOW: port (number) or portName, plus scheme and path ===
1722
1723 # token for "Authorization: Bearer $(cat tokenPath)"
1724 tokenPath =
1725
1726 # server certificate for certificate validation
1727 certPath =
1728
1729 clientCertPath =
1730
1731 insecure = true
1732
1733 includeHelp = false
1734
1735 output =
1736
1737 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1738
1739 whitelist.1 = ^kubernetes_build_info$
1740 whitelist.2 = ^kubeproxy_network_programming_duration_seconds_sum$
1741 whitelist.3 = ^kubeproxy_sync_proxy_rules_duration_seconds_sum$
1742 whitelist.4 = ^kubeproxy_sync_proxy_rules_last_timestamp_seconds$
1743 whitelist.5 = ^kubeproxy_sync_proxy_rules_last_queued_timestamp_seconds$
1744 whitelist.6 = ^kubeproxy_sync_proxy_rules_endpoint_changes_pending$
1745 whitelist.7 = ^kubeproxy_sync_proxy_rules_endpoint_changes_total$
1746 whitelist.8 = ^kubeproxy_sync_proxy_rules_service_changes_pending$
1747 whitelist.9 = ^kubeproxy_sync_proxy_rules_service_changes_total$
1748 whitelist.10 = ^kubeproxy_sync_proxy_rules_iptables_total$
1749 whitelist.11 = ^kubeproxy_sync_proxy_rules_no_local_endpoints_total$
1750 whitelist.12 = ^kubeproxy_iptables_ct_state_invalid_dropped_packets_total$
1751 whitelist.13 = ^kubeproxy_conntrack_reconciler_deleted_entries_total$
1752 whitelist.14 = ^process_cpu_seconds_total$
1753 whitelist.15 = ^process_resident_memory_bytes$
1754 whitelist.16 = ^process_virtual_memory_bytes$
1755 whitelist.17 = ^process_open_fds$
1756 whitelist.18 = ^process_max_fds$
1757 whitelist.19 = ^go_goroutines$
1758 whitelist.20 = ^process_start_time_seconds$
1759
1760 [input.prometheus::kubelet]
1761
1762 disabled = false
1763
1764 type = kubernetes_prometheus
1765
1766 index =
1767
1768 source = kubelet
1769
1770 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1771 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1772 # metricsOutput: an output whose HEC token can write to the metrics index.
1773 metricsIndex =
1774 metricsOutput =
1775
1776 # Override host (environment variables are supported)
1777 host = ${KUBERNETES_NODENAME}
1778
1779 source = kubelet
1780
1781 interval = 60s
1782
1783 timeout = 60s
1784
1785 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1786 # podSelector (with podNamespace): the pods on this node a label selector matches;
1787 # endpoint(s) beside it are the fallback on a node where none runs.
1788
1789 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1790
1791 # endpoint.N: literal URLs, the first that answers
1792
1793 endpoint.1 = https://${KUBERNETES_NODEIP}:10250/metrics
1794
1795 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1796
1797 # === HOW: port (number) or portName, plus scheme and path ===
1798
1799 # token for "Authorization: Bearer $(cat tokenPath)"
1800 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1801
1802 # server certificate for certificate validation
1803 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1804
1805 clientCertPath =
1806
1807 insecure = true
1808
1809 includeHelp = false
1810
1811 output =
1812
1813 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1814
1815 whitelist.1 = ^kubernetes_build_info$
1816 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1817 whitelist.3 = ^kubelet_runtime_operations_errors_total$
1818 whitelist.4 = ^kubelet_cgroup_manager_duration_seconds_sum$
1819 whitelist.5 = ^storage_operation_duration_seconds_sum$
1820 whitelist.6 = ^kubelet_volume_stats_.+$
1821 whitelist.7 = ^kubelet_running_pods$
1822 whitelist.8 = ^kubelet_running_containers$
1823 whitelist.9 = ^kubelet_desired_pods$
1824 whitelist.10 = ^kubelet_pleg_relist_duration_seconds_sum$
1825 whitelist.11 = ^kubelet_pod_start_duration_seconds_sum$
1826 whitelist.12 = ^kubelet_pod_worker_duration_seconds_sum$
1827 whitelist.13 = ^kubelet_started_pods_errors_total$
1828 whitelist.14 = ^kubelet_certificate_manager_client_ttl_seconds$
1829 whitelist.15 = ^rest_client_requests_total$
1830 whitelist.16 = ^rest_client_request_duration_seconds_sum$
1831 whitelist.17 = ^process_cpu_seconds_total$
1832 whitelist.18 = ^process_resident_memory_bytes$
1833 whitelist.19 = ^process_virtual_memory_bytes$
1834 whitelist.20 = ^process_open_fds$
1835 whitelist.21 = ^process_max_fds$
1836 whitelist.22 = ^go_goroutines$
1837 whitelist.23 = ^process_start_time_seconds$
1838
1839 [input.prometheus::kubernetes-api]
1840
1841 disabled = false
1842
1843 type = kubernetes_prometheus
1844
1845 index =
1846
1847 source = kubernetes-api
1848
1849 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1850 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1851 # metricsOutput: an output whose HEC token can write to the metrics index.
1852 metricsIndex =
1853 metricsOutput =
1854
1855 # Override host (environment variables are supported)
1856 host = ${KUBERNETES_NODENAME}
1857
1858 source = kubernetes-api
1859
1860 interval = 60s
1861
1862 timeout = 60s
1863
1864 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1865 # podSelector (with podNamespace): the pods on this node a label selector matches;
1866 # endpoint(s) beside it are the fallback on a node where none runs.
1867 podNamespace = kube-system
1868 podSelector = component=kube-apiserver
1869
1870 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1871
1872 # endpoint.N: literal URLs, the first that answers
1873
1874 endpoint.1 = https://127.0.0.1:6443/metrics
1875 endpoint.2 = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1876
1877 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1878 nodeSelector = node-role.kubernetes.io/control-plane
1879
1880 # === HOW: port (number) or portName, plus scheme and path ===
1881 port = 6443
1882 portName = probe-port
1883 scheme = https
1884 path = /metrics
1885
1886 # token for "Authorization: Bearer $(cat tokenPath)"
1887 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1888
1889 # server certificate for certificate validation
1890 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1891
1892 # the name the server certificate is verified against, when not the address dialed
1893 caName = kubernetes
1894
1895 clientCertPath =
1896
1897 insecure = false
1898
1899 includeHelp = false
1900
1901 output =
1902
1903 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1904
1905 whitelist.1 = ^kubernetes_build_info$
1906 whitelist.2 = ^authenticated_user_requests$
1907 whitelist.3 = ^apiserver_request_total$
1908 whitelist.4 = ^apiserver_current_inflight_requests$
1909 whitelist.5 = ^apiserver_flowcontrol_current_inqueue_requests$
1910 whitelist.6 = ^apiserver_request_terminations_total$
1911 whitelist.7 = ^apiserver_client_certificate_expiration_seconds_bucket$
1912 whitelist.8 = ^apiserver_audit_event_total$
1913 whitelist.9 = ^apiserver_audit_error_total$
1914 whitelist.10 = ^apiserver_resource_objects$
1915 whitelist.11 = ^apiserver_storage_objects$
1916 whitelist.12 = ^process_cpu_seconds_total$
1917 whitelist.13 = ^process_resident_memory_bytes$
1918 whitelist.14 = ^process_virtual_memory_bytes$
1919 whitelist.15 = ^process_open_fds$
1920 whitelist.16 = ^process_max_fds$
1921 whitelist.17 = ^go_goroutines$
1922 whitelist.18 = ^process_start_time_seconds$
1923 whitelist.19 = ^apiserver_request_duration_seconds_sum$
1924
1925 [input.prometheus::scheduler]
1926
1927 disabled = false
1928
1929 type = kubernetes_prometheus
1930
1931 index =
1932
1933 source = scheduler
1934
1935 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1936 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1937 # metricsOutput: an output whose HEC token can write to the metrics index.
1938 metricsIndex =
1939 metricsOutput =
1940
1941 # Override host (environment variables are supported)
1942 host = ${KUBERNETES_NODENAME}
1943
1944 source = scheduler
1945
1946 interval = 60s
1947
1948 timeout = 60s
1949
1950 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1951 # podSelector (with podNamespace): the pods on this node a label selector matches;
1952 # endpoint(s) beside it are the fallback on a node where none runs.
1953 podNamespace = kube-system
1954 podSelector = component=kube-scheduler
1955 podSelector.kops = k8s-app=kube-scheduler
1956
1957 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1958
1959 # endpoint.N: literal URLs, the first that answers
1960
1961 endpoint.1 = https://127.0.0.1:10259/metrics
1962
1963 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1964 nodeSelector = node-role.kubernetes.io/control-plane
1965
1966 # === HOW: port (number) or portName, plus scheme and path ===
1967 port = 10259
1968
1969 scheme = https
1970 path = /metrics
1971
1972 # token for "Authorization: Bearer $(cat tokenPath)"
1973 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1974
1975 # server certificate for certificate validation
1976 certPath =
1977
1978 clientCertPath =
1979
1980 insecure = true
1981
1982 includeHelp = false
1983
1984 output =
1985
1986 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1987
1988 whitelist.1 = ^kubernetes_build_info$
1989 whitelist.2 = ^scheduler_scheduling_attempt_duration_seconds_sum$
1990 whitelist.3 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
1991 whitelist.4 = ^scheduler_pending_pods$
1992 whitelist.5 = ^scheduler_schedule_attempts_total$
1993 whitelist.6 = ^scheduler_queue_incoming_pods_total$
1994 whitelist.7 = ^scheduler_preemption_attempts_total$
1995 whitelist.8 = ^leader_election_master_status$
1996 whitelist.9 = ^rest_client_requests_total$
1997 whitelist.10 = ^rest_client_request_duration_seconds_sum$
1998 whitelist.11 = ^process_cpu_seconds_total$
1999 whitelist.12 = ^process_resident_memory_bytes$
2000 whitelist.13 = ^process_virtual_memory_bytes$
2001 whitelist.14 = ^process_open_fds$
2002 whitelist.15 = ^process_max_fds$
2003 whitelist.16 = ^go_goroutines$
2004 whitelist.17 = ^process_start_time_seconds$
2005
2006 [diagnostics::cpu-vulnerabilities]
2007 settings.interval = 1h
2008 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
2009
2010 [diagnostics::node-reboot-required]
2011 settings.interval = 1h
2012 settings.path = /rootfs/run/reboot-required*