Configuration reference (RHEL)

  1apiVersion: project.openshift.io/v1
  2kind: Project
  3metadata:
  4  labels:
  5    app: collectorforopenshift
  6  name: collectorforopenshift
  7  annotations:
  8    openshift.io/node-selector: ''
  9    openshift.io/description: 'Monitoring OpenShift in Splunk, built by Outcold Solutions'
 10    openshift.io/display-name: 'Collectord for OpenShift'
 11---
 12apiVersion: apiextensions.k8s.io/v1
 13kind: CustomResourceDefinition
 14metadata:
 15  name: configurations.collectord.io
 16spec:
 17  group: collectord.io
 18  versions:
 19    - name: v1
 20      served: true
 21      storage: true
 22      schema:
 23        openAPIV3Schema:
 24          type: object
 25          properties:
 26            spec:
 27              type: object
 28              additionalProperties: true
 29            force:
 30              type: boolean
 31  scope: Cluster
 32  names:
 33    listKind: ConfigurationList
 34    plural: configurations
 35    singular: configuration
 36    kind: Configuration
 37---
 38apiVersion: apiextensions.k8s.io/v1
 39kind: CustomResourceDefinition
 40metadata:
 41  name: splunkoutputs.collectord.io
 42spec:
 43  group: collectord.io
 44  versions:
 45    - name: v1
 46      served: true
 47      storage: true
 48      schema:
 49        openAPIV3Schema:
 50          type: object
 51          properties:
 52            spec:
 53              type: object
 54              properties:
 55                url:
 56                  type: string
 57                  format: uri
 58                insecure:
 59                  type: boolean
 60                token:
 61                  type: string
 62                  description: "Plain token"
 63                tokenFromSecret:
 64                  type: object
 65                  description: "Reference to a Kubernetes Secret"
 66                  properties:
 67                    secret:
 68                      type: string
 69                    key:
 70                      type: string
 71                defaultMetricsIndex:
 72                  type: string
 73                  description: "Index of the metrics-index records sent through this output; empty for the token's default"
 74                incorrectIndexBehavior:
 75                  type: string
 76                  description: "What happens to a record the token refuses"
 77                  enum: ["RedirectToDefault", "Drop", "Retry"]
 78                requireExplicitIndex:
 79                  type: boolean
 80                  description: "Drop a record that carries no index instead of sending it to the token's default"
 81              oneOf:
 82                - required: ["token"]
 83                - required: ["tokenFromSecret"]
 84  scope: Namespaced
 85  names:
 86    listKind: SplunkOutputList
 87    plural: splunkoutputs
 88    singular: splunkoutput
 89    kind: SplunkOutput
 90---
 91apiVersion: v1
 92kind: ServiceAccount
 93metadata:
 94  labels:
 95    app: collectorforopenshift
 96  name: collectorforopenshift
 97  namespace: collectorforopenshift
 98---
 99kind: SecurityContextConstraints
100apiVersion: security.openshift.io/v1
101metadata:
102  name: collectorforopenshift
103  annotations:
104    "helm.sh/hook": pre-install,pre-upgrade
105    "helm.sh/hook-weight": "-10"
106    "helm.sh/hook-delete-policy": before-hook-creation
107allowHostDirVolumePlugin: true
108allowHostIPC: true
109allowHostNetwork: true
110allowHostPID: true
111allowHostPorts: true
112allowPrivilegeEscalation: true
113allowPrivilegedContainer: true
114readOnlyRootFilesystem: false
115allowedCapabilities:
116  - '*'
117allowedUnsafeSysctls:
118  - '*'
119fsGroup:
120  type: RunAsAny
121runAsUser:
122  type: RunAsAny
123seLinuxContext:
124  type: RunAsAny
125supplementalGroups:
126  type: RunAsAny
127seccompProfiles:
128  - '*'
129users:
130  - system:serviceaccount:collectorforopenshift:collectorforopenshift
131volumes:
132  - '*'
133---
134apiVersion: rbac.authorization.k8s.io/v1
135kind: ClusterRole
136metadata:
137  name: collectorforopenshift
138  labels:
139    app: collectorforopenshift
140rules:
141  - apiGroups:
142    - ""
143    resources:
144    - events
145    - namespaces
146    - nodes
147    - nodes/metrics
148    - persistentvolumeclaims
149    - persistentvolumes
150    - pods
151    - replicationcontrollers
152    - resourcequotas
153    - services
154    verbs:
155    - get
156    - list
157    - watch
158  - apiGroups:
159    - apps
160    resources:
161    - daemonsets
162    - deployments
163    - replicasets
164    - statefulsets
165    verbs:
166    - get
167    - list
168    - watch
169  - apiGroups:
170    - batch
171    resources:
172    - cronjobs
173    - jobs
174    verbs:
175    - get
176    - list
177    - watch
178  - apiGroups:
179    - discovery.k8s.io
180    resources:
181    - endpointslices
182    verbs:
183    - get
184    - list
185    - watch
186  - apiGroups:
187    - rbac.authorization.k8s.io
188    resources:
189    - clusterroles
190    verbs:
191    - get
192    - list
193    - watch
194  - apiGroups:
195    - collectord.io
196    resources:
197    - configurations
198    - splunkoutputs
199    verbs:
200    - get
201    - list
202    - watch
203  - apiGroups: []
204    nonResourceURLs:
205    - /metrics
206    resources: []
207    verbs:
208    - get
209  - apiGroups: []
210    nonResourceURLs:
211    - /api
212    - /api/*
213    - /apis
214    - /apis/*
215    resources: []
216    verbs:
217    - get
218  # A SplunkOutput with spec.tokenFromSecret reads the one Secret it names.
219  - apiGroups:
220    - ""
221    resources:
222    - secrets
223    verbs:
224    - get
225  - apiGroups:
226    - apps.openshift.io
227    resources:
228    - deploymentconfigs
229    verbs:
230    - get
231    - list
232    - watch
233  - apiGroups:
234    - quota.openshift.io
235    resources:
236    - clusterresourcequotas
237    verbs:
238    - get
239    - list
240    - watch
241---
242apiVersion: rbac.authorization.k8s.io/v1
243kind: ClusterRoleBinding
244metadata:
245  name: collectorforopenshift
246  labels:
247    app: collectorforopenshift
248roleRef:
249  apiGroup: rbac.authorization.k8s.io
250  kind: ClusterRole
251  name: collectorforopenshift
252subjects:
253  - kind: ServiceAccount
254    name: collectorforopenshift
255    namespace: collectorforopenshift
256---
257apiVersion: v1
258kind: ResourceQuota
259metadata:
260  name: collectorforopenshift-critical-pods
261  namespace: collectorforopenshift
262  labels:
263    app: collectorforopenshift
264spec:
265  hard:
266    pods: 1G
267  scopeSelector:
268    matchExpressions:
269    - scopeName: PriorityClass
270      operator: In
271      values:
272      - system-cluster-critical
273      - system-node-critical
274---
275apiVersion: v1
276kind: ConfigMap
277metadata:
278  name: collectorforopenshift
279  namespace: collectorforopenshift
280  labels:
281    app: collectorforopenshift
282data:
283  001-general.conf: |

284    # The general configuration is used for all deployments
285    #
286    # Run collectord with the flag -conf and specify location of the configuration files.
287    #
288    # You can override all the values using environment variables with the format like
289    #   COLLECTOR__<ANYNAME>=<section>__<key>=<value>
290    # As an example you can set dataPath in [general] section as
291    #   COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
292    # This parameter can be configured using -env-override, set it to empty string to disable this feature
293
294    [general]
295
296    # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
297    # and accept license by changing the value to *true*
298    acceptLicense = false
299
300    # Location for the database
301    # Collectord stores positions of the files and internal state
302    dataPath = ./data/
303
304    # log level (accepted values are trace, debug, info, warn, error, fatal)
305    logLevel = info
306
307    # Internal http server - serves the liveness (/healthz) and readiness (/readyz)
308    # probes. DaemonSets run on the host network, so bind to loopback (127.0.0.1:11888)
309    # to keep the endpoints off the node IP; the kubelet still reaches them via
310    # httpGet.host 127.0.0.1. The addon runs off the host network and overrides the
311    # bind to 0.0.0.0 in 004-addon.conf so the kubelet can reach it on the pod IP.
312    # httpServerBinding = 0.0.0.0:11888
313    httpServerBinding = 127.0.0.1:11888
314    httpServerEndpoints.health = true
315    httpServerEndpoints.ready = true
316    httpServerEndpoints.metrics = false
317    httpServerEndpoints.pprof = false
318
319    httpServerLog = false
320
321    # telemetry report endpoint, set it to empty string to disable telemetry
322    telemetryEndpoint = https://license.outcold.solutions/telemetry/
323
324    licenseEndpoint = https://license.outcold.solutions/license/
325
326    # Only for the Outcold Solutions License Server; one on-premises uses [license.client]
327    licenseServerProxyUrl =
328
329    # user:password
330    licenseServerProxyBasicAuth =
331
332    license =
333
334    # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
335    # Use value below to override specific name
336    hostname =
337
338    # Default output for events, logs and metrics
339    # valid values: splunk and devnull
340    # Use devnull by default if you don't want to redirect data
341    defaultOutput = splunk
342
343    # The index type of every input that sets no indexType: events, metrics (a Splunk metrics
344    # index; set [output.splunk] defaultMetricsIndex) or both, to compare the dashboards
345    defaultIndexType = events
346
347    fileInputBufferSize = 8kb
348
349    fileInputLineMaxSize = 1mb
350
351    # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
352    # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
353    # Better way to configure that is to specify labels for Kubernetes Nodes.
354    # ; fields.my_environment = dev
355    # Identify the cluster if you are planning to monitor multiple clusters
356    fields.openshift_cluster = -
357
358    # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
359    # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
360    # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
361    # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
362
363    # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
364    annotationsSubdomain =
365
366    # configure global thruput per second for forwarded logs (metrics are not included)
367    # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
368    # from the single Collectord instance to 512Kb per second.
369    # You can configure thruput individually for the logs (including specific for container logs) below
370    thruputPerSecond =
371
372    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
373    # older than 7 days
374    tooOldEvents =
375
376    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
377    tooNewEvents =
378
379    # How Collectord spells the fields it composes: "_" (openshift_pod_name, the default) or "."
380    fieldsSeparator =
381
382    # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
383    # detect gzipped files and skip them (based on the extensions or magic numbers)
384    autoSkipGzipFiles = true
385
386    # Publish to non-default outputs asynchronously (default), so a slow or down output does not
387    # block the others; false holds the pipeline back instead of dropping events.
388    multioutput.async = true
389
390    # Buffer size for the async proxy (default 100), per output of each pipeline. When it and
391    # the output's queue are full, events are dropped (multioutput_dropped_events).
392    multioutput.asyncBufferSize = 100
393
394    [license.client]
395    # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
396    url =
397    basicAuth =
398    insecure = false
399    capath =
400    caname =
401    proxyUrl =
402
403    # user:password
404    proxyBasicAuth =
405
406    [input.collectord_metrics]
407
408    disabled = false
409
410    type = openshift_prometheus
411
412    interval = 1m
413
414    output =
415
416    index =
417
418    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
419    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
420    # metricsOutput: an output whose HEC token can write to the metrics index.
421    metricsIndex =
422    metricsOutput =
423
424    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
425    whitelist.1 = ^file_input_open$
426    whitelist.2 = ^file_input_read_bytes$
427    whitelist.3 = ^openshift_handlers$
428    whitelist.4 = ^pipe$
429    whitelist.5 = ^pipelines_num$
430    whitelist.6 = ^splunk_post_bytes_sum.*$
431    whitelist.7 = ^splunk_post_events_count_sum.*$
432    whitelist.8 = ^splunk_post_failed_requests$
433    whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
434    whitelist.10 = ^splunk_post_requests_seconds_sum.*$
435    whitelist.11 = ^splunk_post_retries_required_sum.*$
436
437    [general.kubernetes]
438
439    # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
440    serviceURL =
441
442    # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
443    # Use it only when you need to override it
444    nodeName =
445
446    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
447    certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
448
449    # Default timeout for http responses. The streaming/watch requests depend on this timeout.
450    timeout = 30m
451
452    # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
453    metadataTTL = 30s
454
455    podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
456
457    containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
458
459    # path to the kubelet root location (use it to discover application logs for emptyDir)
460    # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
461    volumesRootDir = /rootfs/var/lib/kubelet/
462
463    # You can attach annotations as a metadata, using the format
464    #   includeAnnotations.{key} = {regexp}
465    # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
466    # the following format:
467    #   includeAnnotations.1 = ^prometheus\.io.*
468    #   includeAnnotations.2 = ^example\.com.*
469
470    # You can exclude labels from metadata, using the format
471    #   excludeLabels.{key} = {regexp}
472    # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
473    # the following format:
474    #   excludeLabels.1 = ^prometheus\.io.*
475    #   excludeLabels.2 = ^example\.com.*
476
477    # watch for changes (annotations) in the objects
478    watch.namespace = v1/namespace
479    watch.deployment = apps/v1/deployment
480    watch.configuration = collectord.io/v1/configuration
481
482    # true lets an annotation name a SplunkOutput of another namespace (splunk::user/<namespace>/<name>),
483    # sending the annotated pod's data with that namespace's HEC token into its indexes
484    crossNamespaceUserOutputs = false
485
486    # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
487    # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
488    # This way Collectord does not generate 403 requests on API Server
489    clusterRole = collectorforopenshift
490
491    # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
492    # You can define which objects Collectord should traverse when it sees Owners.
493    ; traverseOwnership.namespaces = v1/namespace
494
495    # watch for pods annotations, setup prometheus collection
496    # for these pods
497    # Addon listens on Pod Network
498    # DaemonSets listen on Host Network
499    [input.prometheus_auto]
500
501    disabled = false
502
503    type = openshift_prometheus
504
505    index =
506
507    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
508    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
509    # metricsOutput: an output whose HEC token can write to the metrics index.
510    metricsIndex =
511    metricsOutput =
512
513    interval = 60s
514
515    includeHelp = true
516
517    timeout = 30s
518
519    output =
520
521    # Include an Authorization header for the prometheus scrapper
522    # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
523    # authorization.key1 = Bearer FOO
524
525    [output.splunk]
526
527    url =
528
529    # Specify how URL should be picked up (in case if multiple is used)
530    # urlSelection = random|round-robin|random-with-round-robin
531    # where:
532    # * random - choose random url on first selection and a different random one after each failure (connection or HTTP status code >= 500)
533    # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
534    # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
535    #                             failure (connection or HTTP status code >= 500)
536    # With round-robin and random-with-round-robin, the instances on a failed url can all move to the same next one.
537    urlSelection = random
538    token =
539    insecure = false
540    caPath =
541    caName =
542    clientCertPath =
543    clientKeyPath =
544
545    # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
546    # than set by frequency
547    frequency = 5s
548    batchSize = 768K
549
550    # limit by the number of events (0 value has no limit on the number of events)
551    events = 50
552    proxyUrl =
553
554    # user:password
555    proxyBasicAuth =
556
557    # Splunk acknowledgement url (.../services/collector/ack)
558    ackUrl =
559    ackEnabled = false
560    ackTimeout = 3m
561
562    # Timeout specifies a time limit for requests made by collectord.
563    # The timeout includes connection time, any
564    # redirects, and reading the response body.
565    timeout = 30s
566    idleConnTimeout = 5m
567
568    # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
569    # all pipelines, because just some events have incorrect index
570    dedicatedClientPerIndex = true
571
572    # possible values: RedirectToDefault, Drop, Retry
573    incorrectIndexBehavior = RedirectToDefault
574
575    # gzip compression level (nocompression, default, 1...9)
576    compressionLevel = default
577
578    # number of dedicated splunk output threads (to increase throughput above 4k events per second)
579    threads = 2
580
581    # Default algorithm between threads is roundrobin, but you can change it to weighted
582    ; threadsAlgorithm = weighted
583    threadsAlgorithm = weighted
584
585    # For the move to fieldsSeparator = ".": send every built-in field a second time under its
586    # underscore name (events only). A named output inherits the default output's value.
587    ; duplicateFieldsWithUnderscore = true
588    duplicateFieldsWithUnderscore = false
589
590    # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
591    # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
592    # to ignore all events that don't have index defined explicitly
593    ; requireExplicitIndex = true
594    requireExplicitIndex = false
595
596    # Splunk metrics index for the metrics-index records (indexType = metrics or both) of every
597    # input that names no metricsIndex; unset, they land in the HEC token's default index
598    ; defaultMetricsIndex = openshift_metrics
599    defaultMetricsIndex =
600
601    # For messages generated from logs, include unique `event_id` in the event
602    ; includeEventID = false
603    includeEventID = false
604
605    # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
606    # but will allow to handle more events in case of network issues
607    queueSize = 1024

608  002-daemonset.conf: |

 609    [general.cri-o]
 610
 611    # url for CRIO API, only unix socket is supported
 612    url = unix:///rootfs/var/run/crio/crio.sock
 613
 614    # Timeout for http responses to docker client. The streaming requests depend on this timeout.
 615    timeout = 1m
 616
 617    [input.system_stats]
 618
 619    disabled.host = false
 620    disabled.cgroup = false
 621
 622    pathCgroups = /rootfs/sys/fs/cgroup
 623
 624    pathProc = /rootfs/proc
 625
 626    statsInterval = 30s
 627
 628    type.host = openshift_stats_v2_host
 629    type.cgroup = openshift_stats_v2_cgroup
 630
 631    index.host =
 632    index.cgroup =
 633
 634    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
 635    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
 636    # metricsOutput: an output whose HEC token can write to the metrics index.
 637    metricsIndex.host =
 638    metricsIndex.cgroup =
 639    metricsOutput.host =
 640    metricsOutput.cgroup =
 641
 642    output.host =
 643    output.cgroup =
 644
 645    [input.proc_stats]
 646
 647    disabled = false
 648
 649    pathProc = /rootfs/proc
 650
 651    statsInterval = 30s
 652
 653    type = openshift_proc_stats_v2
 654
 655    index.host =
 656    index.cgroup =
 657
 658    # proc filesystem includes by default system threads (there can be over 100 of them)
 659    # these stats do not help with the observability
 660    # excluding them can reduce the size of the index, performance of the searches and usage of the collector
 661    includeSystemThreads = false
 662
 663    output.host =
 664    output.cgroup =
 665
 666    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
 667    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
 668    # metricsOutput: an output whose HEC token can write to the metrics index.
 669    metricsIndex =
 670    metricsOutput =
 671
 672    # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
 673    hideArgs = false
 674
 675    [input.net_stats]
 676
 677    disabled = false
 678
 679    pathProc = /rootfs/proc
 680
 681    statsInterval = 30s
 682
 683    type = openshift_net_stats_v2
 684
 685    index.host =
 686    index.cgroup =
 687
 688    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
 689    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
 690    # metricsOutput: an output whose HEC token can write to the metrics index.
 691    metricsIndex.host =
 692    metricsIndex.cgroup =
 693    metricsOutput.host =
 694    metricsOutput.cgroup =
 695
 696    output.host =
 697    output.cgroup =
 698
 699    [input.net_socket_table]
 700
 701    disabled = false
 702
 703    pathProc = /rootfs/proc
 704
 705    statsInterval = 30s
 706
 707    type = openshift_net_socket_table
 708
 709    index.host =
 710    index.cgroup =
 711
 712    output.host =
 713    output.cgroup =
 714
 715    # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
 716    # that can significally reduces the amount of events
 717    group = true
 718
 719    # Collectord can watch for services, node, and pod IP addresses, and lookup the names
 720    # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
 721    disableLookup = false
 722
 723    [input.mount_stats]
 724
 725    disabled = false
 726
 727    statsInterval = 30s
 728
 729    # root: the filesystem of the kubelet's root directory; auto: every real filesystem, one event each
 730    mounts = root
 731
 732    # with mounts = auto: a regular expression the filesystem type must match, and one the
 733    # mount point must not (empty: the defaults)
 734    include =
 735    exclude =
 736
 737    type = openshift_mount_stats
 738
 739    index =
 740
 741    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
 742    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
 743    # metricsOutput: an output whose HEC token can write to the metrics index.
 744    metricsIndex =
 745    metricsOutput =
 746
 747    output =
 748
 749    [input.disk_stats]
 750
 751    disabled = false
 752
 753    statsInterval = 30s
 754
 755    type = openshift_disk_stats
 756
 757    index =
 758
 759    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
 760    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
 761    # metricsOutput: an output whose HEC token can write to the metrics index.
 762    metricsIndex =
 763    metricsOutput =
 764
 765    output =
 766
 767    [input.files]
 768
 769    disabled = false
 770
 771    # root location of docker log files
 772    # logs are expected in standard docker format like {containerID}/{containerID}-json.log
 773    # rotated files
 774    path = /rootfs/var/lib/docker/containers/
 775
 776    # root location of CRI-O files
 777    # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
 778    crioPath = /rootfs/var/log/pods/
 779
 780    # files are read using polling schema, when reach the EOF how often to check if files got updated
 781    pollingInterval = 250ms
 782
 783    # how often to look for the new files under logs path
 784    walkingInterval = 5s
 785
 786    # include verbose fields in events (file offset)
 787    verboseFields = false
 788
 789    type = openshift_logs
 790
 791    index =
 792
 793    # docker splits events when they are larger than 10-100k (depends on the docker version)
 794    # we join them together by default and forward to Splunk as one event
 795    joinPartialEvents = true
 796
 797    # In case if your containers report messages with terminal colors or other escape sequences
 798    # you can enable strip for all the containers in one place.
 799    # Better is to enable it only for required container with the annotation collectord.io/logs-escapeterminalsequences=true
 800    stripTerminalEscapeSequences = false
 801
 802    # Regexp used for stripping terminal colors, it does not stip all the escape sequences
 803    # Read http://man7.org/linux/man-pages/man4/console_codes.4.html for more information
 804    stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
 805
 806    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
 807    samplingPercent = -1
 808
 809    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
 810    samplingKey =
 811
 812    output =
 813
 814    # configure default thruput per second for for each container log
 815    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
 816    # from the single container to 128Kb per second.
 817    thruputPerSecond =
 818
 819    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
 820    # older than 7 days
 821    tooOldEvents =
 822
 823    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
 824    tooNewEvents =
 825
 826    # Read rotated logs the kubelet compressed before Collectord read them; false counts them lost
 827    readCompressed = true
 828
 829    # Bytes of those logs inflated at once, node-wide, under [general] dataPath
 830    compressedInflateBudget = 256MiB
 831
 832    # Group each stream's repeated lines into one event per run that counts them.
 833    # Off unless true; a workload overrides it with its
 834    # collectord.io/logs-repeat-enabled annotation.
 835    repeatEnabled = false
 836
 837    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
 838    # repeatMaxSpan = 1m
 839
 840    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
 841    # repeatOffsets = false
 842
 843    # What each stream may remember: distinct lines, lines one event stands for, and bytes
 844    # repeatMaxKeys = 256
 845    # repeatMaxCount = 1000
 846    # repeatMaxBytes = 256KB
 847
 848    # Fold each stream's lines of one pattern past foldMaxPerMinute into one summary a minute.
 849    # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
 850    # collectord.io/logs-fold-enabled annotation.
 851    foldEnabled = false
 852
 853    # Lines of one pattern a minute sent before the rest fold
 854    # foldMaxPerMinute = 60
 855
 856    # Lines never folded (a regular expression; empty: the default)
 857    # foldKeep = (?i)error|exception|fatal|panic
 858
 859    # What each stream may keep a minute: its patterns and summaries
 860    # foldMaxBytes = 256KB
 861
 862    # Report each stream's top patterns every interval, as events of their own.
 863    # Off unless true; a workload overrides it with its
 864    # collectord.io/logs-patterns-enabled annotation.
 865    patternsEnabled = false
 866
 867    # How often a report goes out, from 1m to 24h
 868    # patternsInterval = 15m
 869
 870    # How many patterns a report carries, up to 100
 871    # patternsTop = 20
 872
 873    # What each stream's patterns may keep; past it a new one takes the place of the lightest
 874    # patternsMaxBytes = 256KB
 875
 876    # The report events' type (empty: the input's type with _patterns after it)
 877    # patternsType =
 878
 879    [input.app_logs]
 880
 881    disabled = false
 882
 883    # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
 884    root = /rootfs/
 885
 886    # how often to review list of available volumes
 887    syncInterval = 5s
 888
 889    glob = *.log*
 890
 891    # files are read using polling schema, when reach the EOF how often to check if files got updated
 892    pollingInterval = 250ms
 893
 894    # how often to look for the new files under logs path
 895    walkingInterval = 5s
 896
 897    # include verbose fields in events (file offset)
 898    verboseFields = false
 899
 900    type = openshift_logs
 901
 902    index =
 903
 904    # we split files using new line character, with this configuration you can specify what defines the new event
 905    # after new line
 906    eventPatternRegex = ^[^\s]
 907    eventPatternMaxInterval = 100ms
 908    eventPatternMaxWait = 1s
 909    eventPatternMaxSize = 1MB
 910
 911    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
 912    samplingPercent = -1
 913
 914    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
 915    samplingKey =
 916
 917    output =
 918
 919    # configure default thruput per second for for each container log
 920    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
 921    # from the single container to 128Kb per second.
 922    thruputPerSecond =
 923
 924    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
 925    # older than 7 days
 926    tooOldEvents =
 927
 928    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
 929    tooNewEvents =
 930
 931    # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
 932    # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
 933    # of pods, as kubelet cannot unmount the PVC volume from the system
 934    maxHoldAfterClose = 1800s
 935
 936    # Group each file's repeated lines into one event per run that counts them.
 937    # Off unless true; a workload overrides it with its
 938    # collectord.io/volume.<n>-logs-repeat-enabled annotation.
 939    repeatEnabled = false
 940
 941    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
 942    # repeatMaxSpan = 1m
 943
 944    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
 945    # repeatOffsets = false
 946
 947    # What each file may remember: distinct lines, lines one event stands for, and bytes
 948    # repeatMaxKeys = 256
 949    # repeatMaxCount = 1000
 950    # repeatMaxBytes = 256KB
 951
 952    # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
 953    # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
 954    # collectord.io/volume.<n>-logs-fold-enabled annotation.
 955    foldEnabled = false
 956
 957    # Lines of one pattern a minute sent before the rest fold
 958    # foldMaxPerMinute = 60
 959
 960    # Lines never folded (a regular expression; empty: the default)
 961    # foldKeep = (?i)error|exception|fatal|panic
 962
 963    # What each file may keep a minute: its patterns and summaries
 964    # foldMaxBytes = 256KB
 965
 966    # Report each file's top patterns every interval, as events of their own.
 967    # Off unless true; a workload overrides it with its
 968    # collectord.io/volume.<n>-logs-patterns-enabled annotation.
 969    patternsEnabled = false
 970
 971    # How often a report goes out, from 1m to 24h
 972    # patternsInterval = 15m
 973
 974    # How many patterns a report carries, up to 100
 975    # patternsTop = 20
 976
 977    # What each file's patterns may keep; past it a new one takes the place of the lightest
 978    # patternsMaxBytes = 256KB
 979
 980    # The report events' type (empty: the input's type with _patterns after it)
 981    # patternsType =
 982
 983    [input.files::audit-logs]
 984
 985    disabled = false
 986
 987    path = /rootfs/var/log/kube-apiserver/
 988
 989    glob = audit*.log
 990
 991    match =
 992
 993    # limit search only on one level
 994    recursive = false
 995    nodeSelector = node-role.kubernetes.io/master
 996
 997    # files are read using polling schema, when reach the EOF how often to check if files got updated
 998    pollingInterval = 250ms
 999
1000    # how often o look for the new files under logs path
1001    walkingInterval = 5s
1002
1003    # include verbose fields in events (file offset)
1004    verboseFields = false
1005
1006    type = openshift_host_logs
1007
1008    index =
1009
1010    extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1011    extractionMessageField = message
1012
1013    timestampField = timestamp
1014
1015    # format for timestamp
1016    # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1017    timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1018
1019    # timestamp location (if not defined by format)
1020    timestampLocation =
1021
1022    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1023    samplingPercent = -1
1024
1025    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1026    samplingKey =
1027
1028    output =
1029
1030    # configure default thruput per second for this files group
1031    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1032    # from the files in this group to 128Kb per second.
1033    thruputPerSecond =
1034
1035    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1036    # older than 7 days
1037    tooOldEvents =
1038
1039    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1040    tooNewEvents =
1041
1042    # by default every new event should start from not space symbol
1043    eventPattern =
1044
1045    # Blacklisting and whitelisting the logs
1046    # whitelist.0 = ^regexp$
1047    # blacklist.0 = ^regexp$
1048
1049    # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1050    # a spent cap drops the other lines instead of pausing this input
1051    # thruputExempt.0 = ^regexp$
1052
1053    # Group each file's repeated lines into one event per run that counts them.
1054    # Off unless true.
1055    repeatEnabled = false
1056
1057    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1058    # repeatMaxSpan = 1m
1059
1060    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1061    # repeatOffsets = false
1062
1063    # What each file may remember: distinct lines, lines one event stands for, and bytes
1064    # repeatMaxKeys = 256
1065    # repeatMaxCount = 1000
1066    # repeatMaxBytes = 256KB
1067
1068    # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1069    # Lossy: folded lines are not sent. Off unless true.
1070    foldEnabled = false
1071
1072    # Lines of one pattern a minute sent before the rest fold
1073    # foldMaxPerMinute = 60
1074
1075    # Lines never folded (a regular expression; empty: the default)
1076    # foldKeep = (?i)error|exception|fatal|panic
1077
1078    # What each file may keep a minute: its patterns and summaries
1079    # foldMaxBytes = 256KB
1080
1081    # Report each file's top patterns every interval, as events of their own.
1082    # Off unless true.
1083    patternsEnabled = false
1084
1085    # How often a report goes out, from 1m to 24h
1086    # patternsInterval = 15m
1087
1088    # How many patterns a report carries, up to 100
1089    # patternsTop = 20
1090
1091    # What each file's patterns may keep; past it a new one takes the place of the lightest
1092    # patternsMaxBytes = 256KB
1093
1094    # The report events' type (empty: the input's type with _patterns after it)
1095    # patternsType =
1096
1097    [input.files::oauth-apiserver-audit-logs]
1098
1099    disabled = false
1100
1101    path = /rootfs/var/log/oauth-apiserver/
1102
1103    glob = audit*.log
1104
1105    match =
1106
1107    # limit search only on one level
1108    recursive = false
1109    nodeSelector = node-role.kubernetes.io/master
1110
1111    # files are read using polling schema, when reach the EOF how often to check if files got updated
1112    pollingInterval = 250ms
1113
1114    # how often o look for the new files under logs path
1115    walkingInterval = 5s
1116
1117    # include verbose fields in events (file offset)
1118    verboseFields = false
1119
1120    type = openshift_host_logs
1121
1122    index =
1123
1124    extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1125    extractionMessageField = message
1126
1127    timestampField = timestamp
1128
1129    # format for timestamp
1130    # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1131    timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1132
1133    # timestamp location (if not defined by format)
1134    timestampLocation =
1135
1136    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1137    samplingPercent = -1
1138
1139    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1140    samplingKey =
1141
1142    output =
1143
1144    # configure default thruput per second for this files group
1145    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1146    # from the files in this group to 128Kb per second.
1147    thruputPerSecond =
1148
1149    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1150    # older than 7 days
1151    tooOldEvents =
1152
1153    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1154    tooNewEvents =
1155
1156    # by default every new event should start from not space symbol
1157    eventPattern =
1158
1159    # Blacklisting and whitelisting the logs
1160    # whitelist.0 = ^regexp$
1161    # blacklist.0 = ^regexp$
1162
1163    # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1164    # a spent cap drops the other lines instead of pausing this input
1165    # thruputExempt.0 = ^regexp$
1166
1167    # Group each file's repeated lines into one event per run that counts them.
1168    # Off unless true.
1169    repeatEnabled = false
1170
1171    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1172    # repeatMaxSpan = 1m
1173
1174    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1175    # repeatOffsets = false
1176
1177    # What each file may remember: distinct lines, lines one event stands for, and bytes
1178    # repeatMaxKeys = 256
1179    # repeatMaxCount = 1000
1180    # repeatMaxBytes = 256KB
1181
1182    # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1183    # Lossy: folded lines are not sent. Off unless true.
1184    foldEnabled = false
1185
1186    # Lines of one pattern a minute sent before the rest fold
1187    # foldMaxPerMinute = 60
1188
1189    # Lines never folded (a regular expression; empty: the default)
1190    # foldKeep = (?i)error|exception|fatal|panic
1191
1192    # What each file may keep a minute: its patterns and summaries
1193    # foldMaxBytes = 256KB
1194
1195    # Report each file's top patterns every interval, as events of their own.
1196    # Off unless true.
1197    patternsEnabled = false
1198
1199    # How often a report goes out, from 1m to 24h
1200    # patternsInterval = 15m
1201
1202    # How many patterns a report carries, up to 100
1203    # patternsTop = 20
1204
1205    # What each file's patterns may keep; past it a new one takes the place of the lightest
1206    # patternsMaxBytes = 256KB
1207
1208    # The report events' type (empty: the input's type with _patterns after it)
1209    # patternsType =
1210
1211    [input.files::oauth-server-audit-logs]
1212
1213    disabled = false
1214
1215    path = /rootfs/var/log/oauth-server/
1216
1217    glob = audit*.log
1218
1219    match =
1220
1221    # limit search only on one level
1222    recursive = false
1223    nodeSelector = node-role.kubernetes.io/master
1224
1225    # files are read using polling schema, when reach the EOF how often to check if files got updated
1226    pollingInterval = 250ms
1227
1228    # how often o look for the new files under logs path
1229    walkingInterval = 5s
1230
1231    # include verbose fields in events (file offset)
1232    verboseFields = false
1233
1234    type = openshift_host_logs
1235
1236    index =
1237
1238    extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1239    extractionMessageField = message
1240
1241    timestampField = timestamp
1242
1243    # format for timestamp
1244    # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1245    timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1246
1247    # timestamp location (if not defined by format)
1248    timestampLocation =
1249
1250    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1251    samplingPercent = -1
1252
1253    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1254    samplingKey =
1255
1256    output =
1257
1258    # configure default thruput per second for this files group
1259    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1260    # from the files in this group to 128Kb per second.
1261    thruputPerSecond =
1262
1263    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1264    # older than 7 days
1265    tooOldEvents =
1266
1267    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1268    tooNewEvents =
1269
1270    # by default every new event should start from not space symbol
1271    eventPattern =
1272
1273    # Blacklisting and whitelisting the logs
1274    # whitelist.0 = ^regexp$
1275    # blacklist.0 = ^regexp$
1276
1277    # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1278    # a spent cap drops the other lines instead of pausing this input
1279    # thruputExempt.0 = ^regexp$
1280
1281    # Group each file's repeated lines into one event per run that counts them.
1282    # Off unless true.
1283    repeatEnabled = false
1284
1285    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1286    # repeatMaxSpan = 1m
1287
1288    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1289    # repeatOffsets = false
1290
1291    # What each file may remember: distinct lines, lines one event stands for, and bytes
1292    # repeatMaxKeys = 256
1293    # repeatMaxCount = 1000
1294    # repeatMaxBytes = 256KB
1295
1296    # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1297    # Lossy: folded lines are not sent. Off unless true.
1298    foldEnabled = false
1299
1300    # Lines of one pattern a minute sent before the rest fold
1301    # foldMaxPerMinute = 60
1302
1303    # Lines never folded (a regular expression; empty: the default)
1304    # foldKeep = (?i)error|exception|fatal|panic
1305
1306    # What each file may keep a minute: its patterns and summaries
1307    # foldMaxBytes = 256KB
1308
1309    # Report each file's top patterns every interval, as events of their own.
1310    # Off unless true.
1311    patternsEnabled = false
1312
1313    # How often a report goes out, from 1m to 24h
1314    # patternsInterval = 15m
1315
1316    # How many patterns a report carries, up to 100
1317    # patternsTop = 20
1318
1319    # What each file's patterns may keep; past it a new one takes the place of the lightest
1320    # patternsMaxBytes = 256KB
1321
1322    # The report events' type (empty: the input's type with _patterns after it)
1323    # patternsType =
1324
1325    [input.files::openshift-apiserver-audit-logs]
1326
1327    disabled = false
1328
1329    path = /rootfs/var/log/openshift-apiserver/
1330
1331    glob = audit*.log
1332
1333    match =
1334
1335    # limit search only on one level
1336    recursive = false
1337    nodeSelector = node-role.kubernetes.io/master
1338
1339    # files are read using polling schema, when reach the EOF how often to check if files got updated
1340    pollingInterval = 250ms
1341
1342    # how often o look for the new files under logs path
1343    walkingInterval = 5s
1344
1345    # include verbose fields in events (file offset)
1346    verboseFields = false
1347
1348    type = openshift_host_logs
1349
1350    index =
1351
1352    extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1353    extractionMessageField = message
1354
1355    timestampField = timestamp
1356
1357    # format for timestamp
1358    # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1359    timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1360
1361    # timestamp location (if not defined by format)
1362    timestampLocation =
1363
1364    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1365    samplingPercent = -1
1366
1367    # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1368    samplingKey =
1369
1370    output =
1371
1372    # configure default thruput per second for this files group
1373    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1374    # from the files in this group to 128Kb per second.
1375    thruputPerSecond =
1376
1377    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1378    # older than 7 days
1379    tooOldEvents =
1380
1381    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1382    tooNewEvents =
1383
1384    # by default every new event should start from not space symbol
1385    eventPattern =
1386
1387    # Blacklisting and whitelisting the logs
1388    # whitelist.0 = ^regexp$
1389    # blacklist.0 = ^regexp$
1390
1391    # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1392    # a spent cap drops the other lines instead of pausing this input
1393    # thruputExempt.0 = ^regexp$
1394
1395    # Group each file's repeated lines into one event per run that counts them.
1396    # Off unless true.
1397    repeatEnabled = false
1398
1399    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1400    # repeatMaxSpan = 1m
1401
1402    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1403    # repeatOffsets = false
1404
1405    # What each file may remember: distinct lines, lines one event stands for, and bytes
1406    # repeatMaxKeys = 256
1407    # repeatMaxCount = 1000
1408    # repeatMaxBytes = 256KB
1409
1410    # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1411    # Lossy: folded lines are not sent. Off unless true.
1412    foldEnabled = false
1413
1414    # Lines of one pattern a minute sent before the rest fold
1415    # foldMaxPerMinute = 60
1416
1417    # Lines never folded (a regular expression; empty: the default)
1418    # foldKeep = (?i)error|exception|fatal|panic
1419
1420    # What each file may keep a minute: its patterns and summaries
1421    # foldMaxBytes = 256KB
1422
1423    # Report each file's top patterns every interval, as events of their own.
1424    # Off unless true.
1425    patternsEnabled = false
1426
1427    # How often a report goes out, from 1m to 24h
1428    # patternsInterval = 15m
1429
1430    # How many patterns a report carries, up to 100
1431    # patternsTop = 20
1432
1433    # What each file's patterns may keep; past it a new one takes the place of the lightest
1434    # patternsMaxBytes = 256KB
1435
1436    # The report events' type (empty: the input's type with _patterns after it)
1437    # patternsType =
1438
1439    [input.journald]
1440
1441    disabled = false
1442
1443    path.persistent = /rootfs/var/log/journal/
1444
1445    # when reach end of journald, how often to pull
1446    pollingInterval = 250ms
1447
1448    # if you don't want to forward journald from the beginning,
1449    # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1450    startFromRel =
1451
1452    type = openshift_host_logs
1453
1454    index =
1455
1456    # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1457    samplingPercent = -1
1458
1459    # sampling key (should be regexp with the named match pattern `key`)
1460    samplingKey =
1461
1462    # how often to reopen the journald to free old files
1463    reopenInterval = 1h
1464
1465    output =
1466
1467    # configure default thruput per second for journald
1468    # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1469    # from the journald to 128Kb per second.
1470    thruputPerSecond =
1471
1472    # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1473    # older than 7 days
1474    tooOldEvents =
1475
1476    # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1477    tooNewEvents =
1478
1479    # by default every new event should start from not space symbol
1480    eventPattern = ^[^\s]
1481
1482    # By default ignoring verbose hyperkube logs (all INFO messages)
1483    blacklist.1 = ^I\d+.*$
1484
1485    # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1486    # a spent cap drops the other lines instead of pausing journald
1487
1488    # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1489    spawnExternalProcess = false
1490
1491    # Group each writer's repeated lines into one event per run that counts them.
1492    # Off unless true.
1493    # A writer is a unit, identifier, command, process, priority and facility: never grouped with another.
1494    repeatEnabled = false
1495
1496    # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1497    # repeatMaxSpan = 1m
1498
1499    # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1500    # repeatOffsets = false
1501
1502    # What the journal, all its writers together, may remember: distinct lines, lines one event stands for, and bytes
1503    # repeatMaxKeys = 256
1504    # repeatMaxCount = 1000
1505    # repeatMaxBytes = 256KB
1506
1507    # Fold each writer's lines of one pattern past foldMaxPerMinute into one summary a minute.
1508    # Lossy: folded lines are not sent. Off unless true.
1509    # A writer is a unit, identifier, command, process, priority and facility: never folded with another.
1510    foldEnabled = false
1511
1512    # Lines of one pattern a minute sent before the rest fold
1513    # foldMaxPerMinute = 60
1514
1515    # Lines never folded (a regular expression; empty: the default)
1516    # foldKeep = (?i)error|exception|fatal|panic
1517
1518    # What the journal, all its writers together, may keep a minute: its patterns and summaries
1519    # foldMaxBytes = 256KB
1520
1521    # Report the journal's top patterns every interval, as events of their own.
1522    # Off unless true.
1523    # A writer is a unit, identifier, command, process, priority and facility: its lines never share a pattern with another's, and the top patterns are of all its writers together.
1524    patternsEnabled = false
1525
1526    # How often a report goes out, from 1m to 24h
1527    # patternsInterval = 15m
1528
1529    # How many patterns a report carries, up to 100
1530    # patternsTop = 20
1531
1532    # What the journal's patterns may keep; past it a new one takes the place of the lightest
1533    # patternsMaxBytes = 256KB
1534
1535    # The report events' type (empty: the input's type with _patterns after it)
1536    # patternsType =
1537
1538    # Pipe to join events (container logs only)
1539    [pipe.join]
1540
1541    disabled = false
1542
1543    maxInterval = 100ms
1544
1545    maxWait = 1s
1546
1547    maxSize = 1MB
1548
1549    # Default pattern to indicate new message (should start not from space)
1550    patternRegex = ^[^\s]
1551
1552    # You can configure global replace rules for the events, which can help to remove sensitive data
1553    # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1554    # application logs and events.
1555    # In the following example we replace password=TEST with password=********
1556    ; [pipe.replace::name]
1557    ; patternRegex = (password=)([^\s]+)
1558    ; replace = $1********
1559
1560    # You can configure global hash rules for the events, which can help to hide sensitive data
1561    # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1562    # application logs and events.
1563    # In the following example we hash IP addresses with fnv-1a-64
1564    ; [pipe.hash::name]
1565    ; match = (\d{1,3}\.){3}\d{1,3}'
1566    ; function = fnv-1a-64
1567
1568    # Log lines matching patternRegex pass every thruput cap and sampling, in the workloads whose
1569    # fields match every matchRegex.<field>; over its cap such a workload drops its other lines
1570    # instead of pausing. Select by namespace: pod, container and image names are the workload
1571    # owner's to choose, and label fields never match
1572    ; [pipe.thruput_exempt::payments-audit]
1573    ; matchRegex.openshift_namespace = ^payments$
1574    ; patternRegex = ^AUDIT
1575
1576    # Count the events and bytes leaving every pipeline (pipeline_events, pipeline_bytes);
1577    # maxSeries bounds the label combinations. Fields are written with underscores.
1578    ; [pipe.eventcount]
1579    ; labels = index, sourcetype, output
1580    ; fields = openshift_namespace
1581    ; maxSeries = 1000
1582
1583    [input.prometheus::controller]
1584
1585    disabled = false
1586
1587    type = openshift_prometheus
1588
1589    index =
1590
1591    source = controller
1592
1593    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1594    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1595    # metricsOutput: an output whose HEC token can write to the metrics index.
1596    metricsIndex =
1597    metricsOutput =
1598
1599    # Override host (environment variables are supported)
1600    host = ${KUBERNETES_NODENAME}
1601
1602    source = controller
1603
1604    interval = 60s
1605
1606    timeout = 60s
1607
1608    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1609    # podSelector (with podNamespace): the pods on this node a label selector matches;
1610    # endpoint(s) beside it are the fallback on a node where none runs.
1611    podNamespace = openshift-kube-controller-manager
1612    podSelector = app=kube-controller-manager
1613
1614    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1615
1616    # endpoint.N: literal URLs, the first that answers
1617
1618    endpoint.1 = https://127.0.0.1:10257/metrics
1619
1620    # nodeSelector: the nodes the literal endpoint(s) are scraped on
1621    nodeSelector = node-role.kubernetes.io/master
1622
1623    # === HOW: port (number) or portName, plus scheme and path ===
1624    port = 10257
1625
1626    scheme = https
1627    path = /metrics
1628
1629    # token for "Authorization: Bearer $(cat tokenPath)"
1630    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1631
1632    # server certificate for certificate validation
1633    certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
1634
1635    # the name the server certificate is verified against, when not the address dialed
1636    caName = kube-controller-manager.openshift-kube-controller-manager.svc
1637
1638    clientCertPath =
1639
1640    insecure = false
1641
1642    includeHelp = false
1643
1644    output =
1645
1646    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1647
1648    whitelist.1 = ^(kubernetes|openshift)_build_info$
1649    whitelist.2 = ^node_collector_zone_size$
1650    whitelist.3 = ^node_collector_zone_health$
1651    whitelist.4 = ^node_collector_unhealthy_nodes_in_zone$
1652    whitelist.5 = ^node_collector_evictions_total$
1653    whitelist.6 = ^workqueue_depth$
1654    whitelist.7 = ^workqueue_retries_total$
1655    whitelist.8 = ^workqueue_longest_running_processor_seconds$
1656    whitelist.9 = ^leader_election_master_status$
1657    whitelist.10 = ^rest_client_requests_total$
1658    whitelist.11 = ^rest_client_request_duration_seconds_sum$
1659    whitelist.12 = ^process_cpu_seconds_total$
1660    whitelist.13 = ^process_resident_memory_bytes$
1661    whitelist.14 = ^process_virtual_memory_bytes$
1662    whitelist.15 = ^process_open_fds$
1663    whitelist.16 = ^process_max_fds$
1664    whitelist.17 = ^go_goroutines$
1665    whitelist.18 = ^process_start_time_seconds$
1666
1667    [input.prometheus::coredns]
1668
1669    disabled = false
1670
1671    type = openshift_prometheus
1672
1673    index =
1674
1675    source = coredns
1676
1677    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1678    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1679    # metricsOutput: an output whose HEC token can write to the metrics index.
1680    metricsIndex =
1681    metricsOutput =
1682
1683    # Override host (environment variables are supported)
1684    host = ${KUBERNETES_NODENAME}
1685
1686    source = coredns
1687
1688    interval = 60s
1689
1690    timeout = 60s
1691
1692    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1693    # podSelector (with podNamespace): the pods on this node a label selector matches;
1694    # endpoint(s) beside it are the fallback on a node where none runs.
1695    podNamespace = openshift-dns
1696    podSelector = dns.operator.openshift.io/daemonset-dns=default
1697
1698    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1699
1700    # endpoint.N: literal URLs, the first that answers
1701
1702    # nodeSelector: the nodes the literal endpoint(s) are scraped on
1703
1704    # === HOW: port (number) or portName, plus scheme and path ===
1705    port = 9154
1706
1707    scheme = https
1708    path = /metrics
1709
1710    # token for "Authorization: Bearer $(cat tokenPath)"
1711    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1712
1713    # server certificate for certificate validation
1714    certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
1715
1716    # the name the server certificate is verified against, when not the address dialed
1717    caName = dns-default.openshift-dns.svc
1718
1719    clientCertPath =
1720
1721    insecure = false
1722
1723    includeHelp = false
1724
1725    output =
1726
1727    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1728
1729    whitelist.1 = ^coredns_.+$
1730    whitelist.2 = ^go_gc_duration_seconds$
1731    whitelist.3 = ^go_goroutines$
1732    whitelist.4 = ^go_memstats_heap_inuse_bytes$
1733    whitelist.5 = ^process_cpu_seconds_total$
1734    whitelist.6 = ^process_network_receive_bytes_total$
1735    whitelist.7 = ^process_network_transmit_bytes_total$
1736    whitelist.8 = ^process_open_fds$
1737    whitelist.9 = ^process_resident_memory_bytes$
1738    whitelist.10 = ^process_start_time_seconds$
1739    whitelist.11 = ^process_virtual_memory_bytes$
1740
1741    [input.prometheus::etcd]
1742
1743    disabled = false
1744
1745    type = openshift_prometheus
1746
1747    index =
1748
1749    source = etcd
1750
1751    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1752    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1753    # metricsOutput: an output whose HEC token can write to the metrics index.
1754    metricsIndex =
1755    metricsOutput =
1756
1757    # Override host (environment variables are supported)
1758    host = ${KUBERNETES_NODENAME}
1759
1760    source = etcd
1761
1762    interval = 60s
1763
1764    timeout = 60s
1765
1766    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1767    # podSelector (with podNamespace): the pods on this node a label selector matches;
1768    # endpoint(s) beside it are the fallback on a node where none runs.
1769
1770    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1771
1772    # endpoint.N: literal URLs, the first that answers
1773
1774    endpoint.1 = https://:9979/metrics
1775    endpoint.2 = https://:9978/metrics
1776
1777    # nodeSelector: the nodes the literal endpoint(s) are scraped on
1778    nodeSelector = node-role.kubernetes.io/master
1779
1780    # === HOW: port (number) or portName, plus scheme and path ===
1781
1782    # token for "Authorization: Bearer $(cat tokenPath)"
1783    tokenPath =
1784
1785    # server certificate for certificate validation
1786    certPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-*.crt
1787
1788    clientCertPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.crt
1789    clientKeyPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.key
1790
1791    insecure = true
1792
1793    includeHelp = false
1794
1795    output =
1796
1797    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1798
1799    whitelist.1 = ^etcd_server_leader_changes_seen_total$
1800    whitelist.2 = ^etcd_server_has_leader$
1801    whitelist.3 = ^etcd_server_is_leader$
1802    whitelist.4 = ^etcd_server_proposals_committed_total$
1803    whitelist.5 = ^etcd_server_proposals_applied_total$
1804    whitelist.6 = ^etcd_server_proposals_pending$
1805    whitelist.7 = ^etcd_server_proposals_failed_total$
1806    whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1807    whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1808    whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1809    whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1810    whitelist.12 = ^etcd_network_client_grpc_.*$
1811    whitelist.13 = ^grpc_server_handled_total$
1812    whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1813    whitelist.15 = ^etcd_network_peer_sent_failures_total$
1814    whitelist.16 = ^etcd_mvcc_db_total_size_in_bytes$
1815    whitelist.17 = ^etcd_mvcc_db_total_size_in_use_in_bytes$
1816    whitelist.18 = ^etcd_server_quota_backend_bytes$
1817    whitelist.19 = ^etcd_debugging_mvcc_keys_total$
1818    whitelist.20 = ^etcd_server_slow_apply_total$
1819    whitelist.21 = ^etcd_server_slow_read_indexes_total$
1820    whitelist.22 = ^etcd_server_read_indexes_failed_total$
1821    whitelist.23 = ^etcd_server_health_failures$
1822    whitelist.24 = ^process_cpu_seconds_total$
1823    whitelist.25 = ^process_resident_memory_bytes$
1824    whitelist.26 = ^process_virtual_memory_bytes$
1825    whitelist.27 = ^process_open_fds$
1826    whitelist.28 = ^process_max_fds$
1827    whitelist.29 = ^go_goroutines$
1828    whitelist.30 = ^process_start_time_seconds$
1829    whitelist.31 = ^etcd_server_version$
1830    whitelist.32 = ^etcd_cluster_version$
1831    whitelist.33 = ^etcd_server_go_version$
1832    whitelist.34 = ^etcd_server_id$
1833    whitelist.35 = ^etcd_network_peer_round_trip_time_seconds_sum$
1834
1835    # counters, by name, whose series are not sent until they first rise above 0
1836    skipZeroCounters.1 = ^grpc_server_handled_total$
1837
1838    [input.prometheus::kubelet]
1839
1840    disabled = false
1841
1842    type = openshift_prometheus
1843
1844    index =
1845
1846    source = kubelet
1847
1848    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1849    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1850    # metricsOutput: an output whose HEC token can write to the metrics index.
1851    metricsIndex =
1852    metricsOutput =
1853
1854    # Override host (environment variables are supported)
1855    host = ${KUBERNETES_NODENAME}
1856
1857    source = kubelet
1858
1859    interval = 60s
1860
1861    timeout = 60s
1862
1863    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1864    # podSelector (with podNamespace): the pods on this node a label selector matches;
1865    # endpoint(s) beside it are the fallback on a node where none runs.
1866
1867    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1868
1869    # endpoint.N: literal URLs, the first that answers
1870
1871    endpoint.1 = https://${KUBERNETES_NODEIP}:10250/metrics
1872
1873    # nodeSelector: the nodes the literal endpoint(s) are scraped on
1874
1875    # === HOW: port (number) or portName, plus scheme and path ===
1876
1877    # token for "Authorization: Bearer $(cat tokenPath)"
1878    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1879
1880    # server certificate for certificate validation
1881    certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1882
1883    clientCertPath =
1884
1885    insecure = true
1886
1887    includeHelp = false
1888
1889    output =
1890
1891    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1892
1893    whitelist.1 = ^(kubernetes|openshift)_build_info$
1894    whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1895    whitelist.3 = ^kubelet_runtime_operations_errors_total$
1896    whitelist.4 = ^kubelet_cgroup_manager_duration_seconds_sum$
1897    whitelist.5 = ^storage_operation_duration_seconds_sum$
1898    whitelist.6 = ^kubelet_volume_stats_.+$
1899    whitelist.7 = ^kubelet_running_pods$
1900    whitelist.8 = ^kubelet_running_containers$
1901    whitelist.9 = ^kubelet_desired_pods$
1902    whitelist.10 = ^kubelet_pleg_relist_duration_seconds_sum$
1903    whitelist.11 = ^kubelet_pod_start_duration_seconds_sum$
1904    whitelist.12 = ^kubelet_pod_worker_duration_seconds_sum$
1905    whitelist.13 = ^kubelet_started_pods_errors_total$
1906    whitelist.14 = ^kubelet_certificate_manager_client_ttl_seconds$
1907    whitelist.15 = ^rest_client_requests_total$
1908    whitelist.16 = ^rest_client_request_duration_seconds_sum$
1909    whitelist.17 = ^process_cpu_seconds_total$
1910    whitelist.18 = ^process_resident_memory_bytes$
1911    whitelist.19 = ^process_virtual_memory_bytes$
1912    whitelist.20 = ^process_open_fds$
1913    whitelist.21 = ^process_max_fds$
1914    whitelist.22 = ^go_goroutines$
1915    whitelist.23 = ^process_start_time_seconds$
1916
1917    [input.prometheus::kubernetes-api]
1918
1919    disabled = false
1920
1921    type = openshift_prometheus
1922
1923    index =
1924
1925    source = kubernetes-api
1926
1927    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1928    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1929    # metricsOutput: an output whose HEC token can write to the metrics index.
1930    metricsIndex =
1931    metricsOutput =
1932
1933    # Override host (environment variables are supported)
1934    host = ${KUBERNETES_NODENAME}
1935
1936    source = kubernetes-api
1937
1938    interval = 60s
1939
1940    timeout = 60s
1941
1942    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1943    # podSelector (with podNamespace): the pods on this node a label selector matches;
1944    # endpoint(s) beside it are the fallback on a node where none runs.
1945    podNamespace = openshift-kube-apiserver
1946    podSelector = app=openshift-kube-apiserver
1947
1948    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1949
1950    # endpoint.N: literal URLs, the first that answers
1951
1952    endpoint.1 = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1953
1954    # nodeSelector: the nodes the literal endpoint(s) are scraped on
1955    nodeSelector = node-role.kubernetes.io/master
1956
1957    # === HOW: port (number) or portName, plus scheme and path ===
1958    port = 6443
1959
1960    scheme = https
1961    path = /metrics
1962
1963    # token for "Authorization: Bearer $(cat tokenPath)"
1964    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1965
1966    # server certificate for certificate validation
1967    certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1968
1969    # the name the server certificate is verified against, when not the address dialed
1970    caName = kubernetes
1971
1972    clientCertPath =
1973
1974    insecure = false
1975
1976    includeHelp = false
1977
1978    output =
1979
1980    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1981
1982    whitelist.1 = ^(kubernetes|openshift)_build_info$
1983    whitelist.2 = ^authenticated_user_requests$
1984    whitelist.3 = ^apiserver_request_total$
1985    whitelist.4 = ^apiserver_current_inflight_requests$
1986    whitelist.5 = ^apiserver_flowcontrol_current_inqueue_requests$
1987    whitelist.6 = ^apiserver_request_terminations_total$
1988    whitelist.7 = ^apiserver_client_certificate_expiration_seconds_bucket$
1989    whitelist.8 = ^apiserver_audit_event_total$
1990    whitelist.9 = ^apiserver_audit_error_total$
1991    whitelist.10 = ^apiserver_resource_objects$
1992    whitelist.11 = ^apiserver_storage_objects$
1993    whitelist.12 = ^process_cpu_seconds_total$
1994    whitelist.13 = ^process_resident_memory_bytes$
1995    whitelist.14 = ^process_virtual_memory_bytes$
1996    whitelist.15 = ^process_open_fds$
1997    whitelist.16 = ^process_max_fds$
1998    whitelist.17 = ^go_goroutines$
1999    whitelist.18 = ^process_start_time_seconds$
2000    whitelist.19 = ^apiserver_request_duration_seconds_sum$
2001
2002    [input.prometheus::scheduler]
2003
2004    disabled = false
2005
2006    type = openshift_prometheus
2007
2008    index =
2009
2010    source = scheduler
2011
2012    # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
2013    # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
2014    # metricsOutput: an output whose HEC token can write to the metrics index.
2015    metricsIndex =
2016    metricsOutput =
2017
2018    # Override host (environment variables are supported)
2019    host = ${KUBERNETES_NODENAME}
2020
2021    source = scheduler
2022
2023    interval = 60s
2024
2025    timeout = 60s
2026
2027    # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
2028    # podSelector (with podNamespace): the pods on this node a label selector matches;
2029    # endpoint(s) beside it are the fallback on a node where none runs.
2030    podNamespace = openshift-kube-scheduler
2031    podSelector = app=openshift-kube-scheduler
2032
2033    # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
2034
2035    # endpoint.N: literal URLs, the first that answers
2036
2037    endpoint.1 = https://127.0.0.1:10259/metrics
2038
2039    # nodeSelector: the nodes the literal endpoint(s) are scraped on
2040    nodeSelector = node-role.kubernetes.io/master
2041
2042    # === HOW: port (number) or portName, plus scheme and path ===
2043    port = 10259
2044
2045    scheme = https
2046    path = /metrics
2047
2048    # token for "Authorization: Bearer $(cat tokenPath)"
2049    tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
2050
2051    # server certificate for certificate validation
2052    certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
2053
2054    # the name the server certificate is verified against, when not the address dialed
2055    caName = scheduler.openshift-kube-scheduler.svc
2056
2057    clientCertPath =
2058
2059    insecure = false
2060
2061    includeHelp = false
2062
2063    output =
2064
2065    # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
2066
2067    whitelist.1 = ^(kubernetes|openshift)_build_info$
2068    whitelist.2 = ^scheduler_scheduling_attempt_duration_seconds_sum$
2069    whitelist.3 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
2070    whitelist.4 = ^scheduler_pending_pods$
2071    whitelist.5 = ^scheduler_schedule_attempts_total$
2072    whitelist.6 = ^scheduler_queue_incoming_pods_total$
2073    whitelist.7 = ^scheduler_preemption_attempts_total$
2074    whitelist.8 = ^leader_election_master_status$
2075    whitelist.9 = ^rest_client_requests_total$
2076    whitelist.10 = ^rest_client_request_duration_seconds_sum$
2077    whitelist.11 = ^process_cpu_seconds_total$
2078    whitelist.12 = ^process_resident_memory_bytes$
2079    whitelist.13 = ^process_virtual_memory_bytes$
2080    whitelist.14 = ^process_open_fds$
2081    whitelist.15 = ^process_max_fds$
2082    whitelist.16 = ^go_goroutines$
2083    whitelist.17 = ^process_start_time_seconds$
2084
2085    [diagnostics::cpu-vulnerabilities]
2086    settings.interval = 1h
2087    settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
2088
2089    [diagnostics::node-reboot-required]
2090    settings.interval = 1h
2091    settings.path = /rootfs/run/reboot-required*