Annotations reference - Monitoring OpenShift

Look up every annotation Collectord recognizes, grouped by the datatype it controls. For usage, examples and patterns, see the companion Annotations page.

Available since Collectord version 26.10

Collectord refuses an annotation that would pass a workload’s data off as Collectord’s own records:

Source types. The source type of one of Collectord’s own inputs: openshift_host_logs, openshift_events, openshift_stats_v2_host and the rest. The container logs’ own type and yours, such as nginx_access, stay allowed.
User fields. A user field named like one Collectord sets: syslog_*, systemd_unit, sourcetype, and the namespace, pod and container names and ids.
Extraction groups. An extraction group with one of those names.

A refused annotation sets nothing. Collectord logs it once per object as invalid annotation, and collectord describe lists it under problems. The configuration can still set any of these.

General annotations
- collectord.io/index - change the events index for all the data forwarded for this Pod: container logs, application logs, and stats and Prometheus metrics sent to an events index, and on a namespace its events and objects too. A metrics index comes from elsewhere: see Events index and metrics index
- collectord.io/source - change the source for all the data forwarded for this Pod (metrics, container logs, application logs)
- collectord.io/type - change the sourcetype for all the data forwarded for this Pod (metrics, container logs, application logs)
- collectord.io/host - change the host for all the data forwarded for this Pod (metrics, container logs, application logs)
- collectord.io/output - change the output for all the data forwarded for this Pod: devnull, splunk, a named output as splunk::<name>, or a SplunkOutput as splunk::user/<namespace>/<name>
- collectord.io/userfields.{fieldname} - attach custom fields to events
Annotations for container logs
- collectord.io/logs-index - change the index for the container logs forwarded from this Pod
- collectord.io/logs-source - change the source for the container logs forwarded from this Pod
- collectord.io/logs-type - change the sourcetype for the container logs forwarded from this Pod
- collectord.io/logs-host - change the host for the container logs forwarded from this Pod
- collectord.io/logs-eventpattern - the regex that matches the first line of each event in the Pod’s logs
- collectord.io/logs-replace.{N}-search - the regex the replace pipe searches for
- collectord.io/logs-replace.{N}-val - the replacement for the replace pipe
- collectord.io/logs-hashing.{N}-match - the regex matching the value to hash
- collectord.io/logs-hashing.{N}-function - the hash function (default sha256): adler-32, crc-32-ieee, crc-32-castagnoli, crc-32-koopman, crc-64-iso, crc-64-ecma, fnv-1-64, fnv-1a-64, fnv-1-32, fnv-1a-32, fnv-1-128, fnv-1a-128, md5, sha1, sha256, sha384 or sha512
- collectord.io/logs-extraction - the regex for field extraction
- collectord.io/logs-extractionMessageField - the field that becomes the message (default: the regex’s last unnamed group)
- collectord.io/logs-timestampfield - the extracted field that holds the timestamp
- collectord.io/logs-timestampformat - the timestamp format
- collectord.io/logs-timestampsetmonth - set the timestamp’s month to the current month
- collectord.io/logs-timestampsetday - set the timestamp’s day to the current day
- collectord.io/logs-timestamplocation - the timestamp’s location, when the format sets none
- collectord.io/logs-joinpartial - join partial events
- collectord.io/logs-joinmultiline - join multiline logs (the default depends on [pipe.join] disabled)
- collectord.io/logs-eventPatternMaxInterval - (26.10+) join the lines written within this interval of the event’s first line (default: [pipe.join] maxInterval)
- collectord.io/logs-eventPatternMaxWait - (26.10+) send a joined event once it is this old (default: [pipe.join] maxWait)
- collectord.io/logs-eventPatternMaxSize - (26.10+) cap a joined event at this size (default: [pipe.join] maxSize)
- collectord.io/logs-repeat-enabled - (26.10+) send repeated lines as one event that counts them: see Reduce log volume
- collectord.io/logs-repeat-maxspan - (26.10+) how long repeats are held before their event goes out, up to 10m (default 1m)
- collectord.io/logs-repeat-offsets - (26.10+) add each line’s time, in milliseconds from the event’s, as collectord_repeat_offsets
- collectord.io/logs-fold-enabled - (26.10+) fold storms of alike lines into one summary a minute (lossy)
- collectord.io/logs-fold-maxperminute - (26.10+) lines of one pattern sent each minute before the rest fold (default 60)
- collectord.io/logs-fold-keep - (26.10+) lines never folded; replaces the default (?i)error|exception|fatal|panic
- collectord.io/logs-patterns-enabled - (26.10+) report the stream’s heaviest log patterns
- collectord.io/logs-escapeterminalsequences - escape terminal sequences (including colors)
- collectord.io/logs-override.{N}-match - the regex that selects the events to override
- collectord.io/logs-override.{N}-index - the index for the matched events
- collectord.io/logs-override.{N}-source - the source for the matched events
- collectord.io/logs-override.{N}-type - the type for the matched events
- collectord.io/logs-output - change the output: devnull, splunk, or any output collectord.io/output takes (not available for stdout or stderr alone)
- collectord.io/logs-disabled - disable all log processing for this container (not available for stdout or stderr alone)
- collectord.io/logs-sampling-percent - the percentage of logs to forward to Splunk
- collectord.io/logs-sampling-key - a regex selecting the key for hash-based sampling
- collectord.io/logs-ThruputPerSecond - the maximum amount of logs per second for this container, for example 128Kb, 1024b
- collectord.io/logs-TooOldEvents - ignore events older than this duration, for example 168h, 24h
- collectord.io/logs-TooNewEvents - ignore events more than this duration in the future, for example 1h, 30m
- collectord.io/logs-whitelist - forward to Splunk only the log messages matching this pattern
- collectord.io/logs-userfields.{fieldname} - attach custom fields to events
- Settings for stdout alone:
  - collectord.io/stdout-logs-index
  - collectord.io/stdout-logs-source
  - collectord.io/stdout-logs-type
  - collectord.io/stdout-logs-host
  - collectord.io/stdout-logs-eventpattern
  - collectord.io/stdout-logs-replace.{N}-search
  - collectord.io/stdout-logs-replace.{N}-val
  - collectord.io/stdout-logs-hashing.{N}-match
  - collectord.io/stdout-logs-hashing.{N}-function
  - collectord.io/stdout-logs-extraction
  - collectord.io/stdout-logs-extractionMessageField
  - collectord.io/stdout-logs-timestampfield
  - collectord.io/stdout-logs-timestampformat
  - collectord.io/stdout-logs-timestampsetmonth
  - collectord.io/stdout-logs-timestampsetday
  - collectord.io/stdout-logs-timestamplocation
  - collectord.io/stdout-logs-joinpartial
  - collectord.io/stdout-logs-joinmultiline
  - collectord.io/stdout-logs-eventPatternMaxInterval (26.10+)
  - collectord.io/stdout-logs-eventPatternMaxWait (26.10+)
  - collectord.io/stdout-logs-eventPatternMaxSize (26.10+)
  - collectord.io/stdout-logs-repeat-enabled (26.10+)
  - collectord.io/stdout-logs-repeat-maxspan (26.10+)
  - collectord.io/stdout-logs-repeat-offsets (26.10+)
  - collectord.io/stdout-logs-fold-enabled (26.10+)
  - collectord.io/stdout-logs-fold-maxperminute (26.10+)
  - collectord.io/stdout-logs-fold-keep (26.10+)
  - collectord.io/stdout-logs-patterns-enabled (26.10+)
  - collectord.io/stdout-logs-escapeterminalsequences
  - collectord.io/stdout-logs-override.{N}-match
  - collectord.io/stdout-logs-override.{N}-index
  - collectord.io/stdout-logs-override.{N}-source
  - collectord.io/stdout-logs-override.{N}-type
  - collectord.io/stdout-logs-sampling-percent
  - collectord.io/stdout-logs-sampling-key
  - collectord.io/stdout-logs-whitelist
- Settings for stderr alone:
  - collectord.io/stderr-logs-index
  - collectord.io/stderr-logs-source
  - collectord.io/stderr-logs-type
  - collectord.io/stderr-logs-host
  - collectord.io/stderr-logs-eventpattern
  - collectord.io/stderr-logs-replace.{N}-search
  - collectord.io/stderr-logs-replace.{N}-val
  - collectord.io/stderr-logs-hashing.{N}-match
  - collectord.io/stderr-logs-hashing.{N}-function
  - collectord.io/stderr-logs-extraction
  - collectord.io/stderr-logs-extractionMessageField
  - collectord.io/stderr-logs-timestampfield
  - collectord.io/stderr-logs-timestampformat
  - collectord.io/stderr-logs-timestampsetmonth
  - collectord.io/stderr-logs-timestampsetday
  - collectord.io/stderr-logs-timestamplocation
  - collectord.io/stderr-logs-joinpartial
  - collectord.io/stderr-logs-joinmultiline
  - collectord.io/stderr-logs-eventPatternMaxInterval (26.10+)
  - collectord.io/stderr-logs-eventPatternMaxWait (26.10+)
  - collectord.io/stderr-logs-eventPatternMaxSize (26.10+)
  - collectord.io/stderr-logs-repeat-enabled (26.10+)
  - collectord.io/stderr-logs-repeat-maxspan (26.10+)
  - collectord.io/stderr-logs-repeat-offsets (26.10+)
  - collectord.io/stderr-logs-fold-enabled (26.10+)
  - collectord.io/stderr-logs-fold-maxperminute (26.10+)
  - collectord.io/stderr-logs-fold-keep (26.10+)
  - collectord.io/stderr-logs-patterns-enabled (26.10+)
  - collectord.io/stderr-logs-escapeterminalsequences
  - collectord.io/stderr-logs-override.{N}-match
  - collectord.io/stderr-logs-override.{N}-index
  - collectord.io/stderr-logs-override.{N}-source
  - collectord.io/stderr-logs-override.{N}-type
  - collectord.io/stderr-logs-sampling-percent
  - collectord.io/stderr-logs-sampling-key
  - collectord.io/stderr-logs-whitelist
Annotations for container stats
- collectord.io/stats-index - change the index for the container metrics forwarded from this Pod
- collectord.io/stats-source - change the source for the container metrics forwarded from this Pod
- collectord.io/stats-type - change the sourcetype for the container metrics forwarded from this Pod
- collectord.io/stats-host - change the host for the container metrics forwarded from this Pod
- collectord.io/stats-output - change the output: devnull, splunk, or any output collectord.io/output takes
- collectord.io/stats-interval - how often to collect stats, overriding the default interval
- collectord.io/stats-userfields.{fieldname} - attach custom fields to events
Annotations for container processes stats
- collectord.io/procstats-index - change the index for the container process metrics forwarded from this Pod
- collectord.io/procstats-source - change the source for the container process metrics forwarded from this Pod
- collectord.io/procstats-type - change the type for the container process metrics forwarded from this Pod
- collectord.io/procstats-host - change the host for the container process metrics forwarded from this Pod
- collectord.io/procstats-output - change the output: devnull, splunk, or any output collectord.io/output takes
- collectord.io/procstats-userfields.{fieldname} - attach custom fields to events
- collectord.io/procstats-hideargs - (5.24.440+) hide the processes’ command-line arguments
Annotations for container network stats
- collectord.io/netstats-index - change the index for the container network metrics forwarded from this Pod
- collectord.io/netstats-source - change the source for the container network metrics forwarded from this Pod
- collectord.io/netstats-type - change the type for the container network metrics forwarded from this Pod
- collectord.io/netstats-host - change the host for the container network metrics forwarded from this Pod
- collectord.io/netstats-output - change the output: devnull, splunk, or any output collectord.io/output takes
- collectord.io/netstats-interval - how often to collect stats, overriding the default interval
- collectord.io/netstats-userfields.{fieldname} - attach custom fields to events
Annotations for container network socket table
- collectord.io/nettable-index - change the index for the container network socket table forwarded from this Pod
- collectord.io/nettable-source - change the source for the container network socket table forwarded from this Pod
- collectord.io/nettable-type - change the type for the container network socket table forwarded from this Pod
- collectord.io/nettable-host - change the host for the container network socket table forwarded from this Pod
- collectord.io/nettable-output - change the output: devnull, splunk, or any output collectord.io/output takes
- collectord.io/nettable-interval - how often to collect the socket table, overriding the default interval
- collectord.io/nettable-userfields.{fieldname} - attach custom fields to events
Annotations for events (can be applied only to namespaces)
- collectord.io/events-index - change the index for the namespace’s events
- collectord.io/events-source - change the source for the namespace’s events
- collectord.io/events-type - change the source type for the namespace’s events
- collectord.io/events-host - change the host for the namespace’s events
- collectord.io/events-userfields.{fieldname} - attach custom fields to events
- collectord.io/events-output - (26.04.1+) change the output for the events published on the namespace
Annotations for application logs
- collectord.io/volume.{N}-logs-name - the name of the volume attached to the Pod
- collectord.io/volume.{N}-logs-index - the index for the logs forwarded from the volume
- collectord.io/volume.{N}-logs-output - the output for the logs forwarded from the volume
- collectord.io/volume.{N}-logs-source - change the source for logs forwarded from the volume
- collectord.io/volume.{N}-logs-type - change the type for logs forwarded from the volume
- collectord.io/volume.{N}-logs-host - change the host for logs forwarded from the volume
- collectord.io/volume.{N}-logs-eventpattern - the regex that matches the first line of each event in the volume’s logs
- collectord.io/volume.{N}-logs-repeat-enabled - (26.10+) send repeated lines of the volume’s logs as one event that counts them
- collectord.io/volume.{N}-logs-fold-enabled - (26.10+) fold storms of alike lines in the volume’s logs (lossy)
- collectord.io/volume.{N}-logs-patterns-enabled - (26.10+) report the heaviest log patterns of the volume’s logs
- collectord.io/volume.{N}-logs-replace.{N}-search - the regex the replace pipe searches for
- collectord.io/volume.{N}-logs-replace.{N}-val - the replacement for the replace pipe
- collectord.io/volume.{N}-logs-hashing.{N}-match - the regex matching the value to hash
- collectord.io/volume.{N}-logs-hashing.{N}-function - the hash function (default sha256): adler-32, crc-32-ieee, crc-32-castagnoli, crc-32-koopman, crc-64-iso, crc-64-ecma, fnv-1-64, fnv-1a-64, fnv-1-32, fnv-1a-32, fnv-1-128, fnv-1a-128, md5, sha1, sha256, sha384 or sha512
- collectord.io/volume.{N}-logs-extraction - the regex for field extraction
- collectord.io/volume.{N}-logs-extractionMessageField - the field that becomes the message (default: the regex’s last unnamed group)
- collectord.io/volume.{N}-logs-timestampfield - the field that holds the timestamp
- collectord.io/volume.{N}-logs-timestampformat - the timestamp format
- collectord.io/volume.{N}-logs-timestampsetmonth - set the timestamp’s month to the current month
- collectord.io/volume.{N}-logs-timestampsetday - set the timestamp’s day to the current day
- collectord.io/volume.{N}-logs-timestamplocation - the timestamp’s location, when the format sets none
- collectord.io/volume.{N}-logs-glob - the glob pattern that selects the log files
- collectord.io/volume.{N}-logs-match - the regex that selects the log files
- collectord.io/volume.{N}-logs-recursive - whether to walk the volume’s directories recursively
- collectord.io/volume.{N}-logs-override.{N}-match - the regex that selects the events to override
- collectord.io/volume.{N}-logs-override.{N}-index - the index for the matched events
- collectord.io/volume.{N}-logs-override.{N}-source - the source for the matched events
- collectord.io/volume.{N}-logs-override.{N}-type - the type for the matched events
- collectord.io/volume.{N}-logs-sampling-percent - the percentage of logs to forward to Splunk
- collectord.io/volume.{N}-logs-sampling-key - a regex selecting the key for hash-based sampling
- collectord.io/volume.{N}-logs-ThruputPerSecond - the maximum amount of logs per second for this container, for example 128Kb, 1024b
- collectord.io/volume.{N}-logs-TooOldEvents - ignore events older than this duration, for example 168h, 24h
- collectord.io/volume.{N}-logs-TooNewEvents - ignore events more than this duration in the future, for example 1h, 30m
- collectord.io/volume.{N}-logs-whitelist - forward to Splunk only the log messages matching this pattern
- collectord.io/volume.{N}-logs-userfields.{fieldname} - attach custom fields to events
- collectord.io/volume.{N}-logs-maxholdafterclose - how long Collectord may keep the files on a PVC open after the pod terminates, as a duration such as 5s or 1800s
- collectord.io/volume.{N}-logs-onvolumedatabase - (5.20.400+) keep Collectord’s acknowledgement database for this volume on the volume itself, for a volume more than one host may use
- collectord.io/volume.{N}-logs-withlock - (5.24.440+) lock the files while forwarding their logs, so other Collectord instances don’t read them
Annotations for forwarding metrics in Prometheus format
- collectord.io/prometheus.{N}-port - (required) the port to collect metrics from
- collectord.io/prometheus.{N}-index - the index for the metrics
- collectord.io/prometheus.{N}-source - the source for the metrics (default /openshift/{openshift_pod_id})
- collectord.io/prometheus.{N}-type - the type for the metrics (default: set in [input.prometheus_auto] in the Collectord configuration)
- collectord.io/prometheus.{N}-host - the host for the metrics (default: the node name)
- collectord.io/prometheus.{N}-path - the URL path of the metrics
- collectord.io/prometheus.{N}-query - the raw URL query for the metrics
- collectord.io/prometheus.{N}-interval - how often to collect metrics (default: set in [input.prometheus_auto] in the Collectord configuration)
- collectord.io/prometheus.{N}-includehelp - include the metrics’ help text (default false)
- collectord.io/prometheus.{N}-insecure - skip certificate verification when the scheme is https (default false)
- collectord.io/prometheus.{N}-scheme - the scheme, http or https (default http)
- collectord.io/prometheus.{N}-username - the basic auth username
- collectord.io/prometheus.{N}-password - the basic auth password
- collectord.io/prometheus.{N}-whitelist - the whitelist regex
- collectord.io/prometheus.{N}-blacklist - the blacklist regex
- collectord.io/prometheus.{N}-authorizationkey - send the Authorization header that authorization.{key} sets under [input.prometheus_auto] in the ConfigMap
- collectord.io/prometheus.{N}-caname - the hostname to verify on the returned certificates, unless insecure is set
- collectord.io/prometheus.{N}-output - (5.23.430+) the output for the metrics
- collectord.io/prometheus.{N}-indexType - (5.24.440+) the index type for the metrics: events, metrics, or (26.10+) both (default: the indexType of [input.prometheus_auto], else [general] defaultIndexType, else events)
- collectord.io/prometheus.{N}-metricsIndex - (26.10+) the metrics index for the metrics (default: [input.prometheus_auto]’s metricsIndex, else the output’s defaultMetricsIndex; on an output of the workload’s own, that output’s defaultMetricsIndex; see Events index and metrics index)
- collectord.io/prometheus.{N}-metricsOutput - (26.10+) send the metrics through another Splunk output, one whose HEC token allows the metrics index