Every annotation Collectord recognizes for the syslog forwarder, grouped by the datatype it controls. For usage, examples, and patterns, see the companion Annotations page. All annotations use the syslog.collectord.io/ prefix; annotations under collectord.collectord.io/{annotation} apply to every Collectord instance regardless of subdomain.
26.10Collectord refuses an annotation that would pass a workload’s data off as Collectord’s own records: the source type of one of Collectord’s own inputs (k8s_host_logs, k8s_events, k8s_audit_logs and the rest; the container logs’ own type and yours, such as nginx_access, stay allowed), a user field named like one Collectord sets (syslog_*, systemd_unit, and the namespace, pod and container names and ids), or an extraction group with one of those names. A refused annotation sets nothing: Collectord logs it once per object as invalid annotation, and collectord describe lists it under problems. The configuration can still set any of these.
- General annotations
syslog.collectord.io/source- change the source for all the data forwarded for this Pod (container logs, application logs)syslog.collectord.io/type- change the sourcetype for all the data forwarded for this Pod (container logs, application logs)syslog.collectord.io/host- change the host for all the data forwarded for this Pod (container logs, application logs)syslog.collectord.io/output- change the output todevnullorsyslogsyslog.collectord.io/userfields.{fieldname}- attach custom fields to events
- Annotations for container logs
syslog.collectord.io/logs-source- change the source for the container logs forwarded from this Podsyslog.collectord.io/logs-type- change the sourcetype for the container logs forwarded from this Podsyslog.collectord.io/logs-host- change the host for the container logs forwarded from this Podsyslog.collectord.io/logs-eventpattern- set the regex identifying the event start pattern for Pod logssyslog.collectord.io/logs-replace.{N}-search- define the search pattern for the replace pipesyslog.collectord.io/logs-replace.{N}-val- define the replace pattern for the replace pipesyslog.collectord.io/logs-hashing.{N}-match- the regexp for a matched valuesyslog.collectord.io/logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)syslog.collectord.io/logs-extraction- define the regexp for fields extractionsyslog.collectord.io/logs-extractionMessageField- specify the field name for the message (by default last unnamed group in regexp)syslog.collectord.io/logs-timestampfield- define the field for timestamp (after fields extraction)syslog.collectord.io/logs-timestampformat- define the timestamp formatsyslog.collectord.io/logs-timestampsetmonth- define if month should be set to current for timestampsyslog.collectord.io/logs-timestampsetday- define if day should be set to current for timestampsyslog.collectord.io/logs-timestamplocation- define timestamp location if not set by formatsyslog.collectord.io/logs-joinpartial- join partial eventssyslog.collectord.io/logs-joinmultiline- join multiline logs (default value depends on[pipe.join] disabled)syslog.collectord.io/logs-eventPatternMaxInterval- (26.10+) join the lines written within this interval of the event’s first line (default:[pipe.join] maxInterval)syslog.collectord.io/logs-eventPatternMaxWait- (26.10+) send a joined event once it is this old (default:[pipe.join] maxWait)syslog.collectord.io/logs-eventPatternMaxSize- (26.10+) cap a joined event at this size (default:[pipe.join] maxSize)syslog.collectord.io/logs-repeat-enabled- (26.10+) send repeated lines as one event that counts them, whensyslog.formatnames{{collectord_repeat_count}}, see Reduce log volumesyslog.collectord.io/logs-repeat-maxspan- (26.10+) how long repeats are held before their event goes out, up to10m(default1m)syslog.collectord.io/logs-repeat-offsets- (26.10+) add every line’s time in milliseconds from the event’s (collectord_repeat_offsets)syslog.collectord.io/logs-fold-enabled- (26.10+) fold storms of alike lines into one summary a minute (lossy), whensyslog.formatnames{{collectord_fold_count}}syslog.collectord.io/logs-fold-maxperminute- (26.10+) lines of one pattern sent each minute before the rest fold (default60)syslog.collectord.io/logs-fold-keep- (26.10+) lines never folded; replaces the default(?i)error|exception|fatal|panicsyslog.collectord.io/logs-patterns-enabled- (26.10+) accepted, but a syslog output carries no pattern reportsyslog.collectord.io/logs-escapeterminalsequences- escape terminal sequences (including colors)syslog.collectord.io/logs-override.{N}-match- match for override patternsyslog.collectord.io/logs-override.{N}-source- override source for matched eventssyslog.collectord.io/logs-override.{N}-type- override type for matched eventssyslog.collectord.io/logs-output- change the output todevnullorsyslog(this annotation cannot be specified for stderr and stdout)syslog.collectord.io/logs-disabled- disable any log processing for this container (this annotation cannot be specified for stderr and stdout)syslog.collectord.io/logs-sampling-percent- specify the % value of logs that should be forwarded to the syslog serversyslog.collectord.io/logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valuessyslog.collectord.io/logs-ThruputPerSecond- set the thruput for this container, maximum amount of logs per second, for example128Kb,1024bsyslog.collectord.io/logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24hsyslog.collectord.io/logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30msyslog.collectord.io/logs-whitelist- allow to configure pattern for log messages, only log messages matching this pattern will be forwardedsyslog.collectord.io/logs-userfields.{fieldname}- attach custom fields to events- Specific for
stdout, with the annotations below you can define configuration specific forstdoutsyslog.collectord.io/stdout-logs-sourcesyslog.collectord.io/stdout-logs-typesyslog.collectord.io/stdout-logs-hostsyslog.collectord.io/stdout-logs-eventpatternsyslog.collectord.io/stdout-logs-replace.{N}-searchsyslog.collectord.io/stdout-logs-replace.{N}-valsyslog.collectord.io/stdout-logs-hashing.{N}-match-syslog.collectord.io/stdout-logs-hashing.{N}-function-syslog.collectord.io/stdout-logs-extractionsyslog.collectord.io/stdout-logs-extractionMessageField-syslog.collectord.io/stdout-logs-timestampfieldsyslog.collectord.io/stdout-logs-timestampformatsyslog.collectord.io/stdout-logs-timestampsetmonthsyslog.collectord.io/stdout-logs-timestampsetdaysyslog.collectord.io/stdout-logs-timestamplocationsyslog.collectord.io/stdout-logs-joinpartialsyslog.collectord.io/stdout-logs-joinmultiline-syslog.collectord.io/stdout-logs-eventPatternMaxInterval- (26.10+)syslog.collectord.io/stdout-logs-eventPatternMaxWait- (26.10+)syslog.collectord.io/stdout-logs-eventPatternMaxSize- (26.10+)syslog.collectord.io/stdout-logs-repeat-enabled- (26.10+)syslog.collectord.io/stdout-logs-repeat-maxspan- (26.10+)syslog.collectord.io/stdout-logs-repeat-offsets- (26.10+)syslog.collectord.io/stdout-logs-fold-enabled- (26.10+)syslog.collectord.io/stdout-logs-fold-maxperminute- (26.10+)syslog.collectord.io/stdout-logs-fold-keep- (26.10+)syslog.collectord.io/stdout-logs-escapeterminalsequencessyslog.collectord.io/stdout-logs-override.{N}-match-syslog.collectord.io/stdout-logs-override.{N}-source-syslog.collectord.io/stdout-logs-override.{N}-type-syslog.collectord.io/stdout-logs-sampling-percent-syslog.collectord.io/stdout-logs-sampling-key-syslog.collectord.io/stdout-logs-whitelist-
- Specific for
stderr, with the annotations below you can define configuration specific forstderrsyslog.collectord.io/stderr-logs-sourcesyslog.collectord.io/stderr-logs-typesyslog.collectord.io/stderr-logs-hostsyslog.collectord.io/stderr-logs-eventpatternsyslog.collectord.io/stderr-logs-replace.{N}-searchsyslog.collectord.io/stderr-logs-replace.{N}-valsyslog.collectord.io/stderr-logs-hashing.{N}-match-syslog.collectord.io/stderr-logs-hashing.{N}-function-syslog.collectord.io/stderr-logs-extractionsyslog.collectord.io/stderr-logs-extractionMessageField-syslog.collectord.io/stderr-logs-timestampfieldsyslog.collectord.io/stderr-logs-timestampformatsyslog.collectord.io/stderr-logs-timestampsetmonthsyslog.collectord.io/stderr-logs-timestampsetdaysyslog.collectord.io/stderr-logs-timestamplocationsyslog.collectord.io/stderr-logs-joinpartialsyslog.collectord.io/stderr-logs-joinmultiline-syslog.collectord.io/stderr-logs-eventPatternMaxInterval- (26.10+)syslog.collectord.io/stderr-logs-eventPatternMaxWait- (26.10+)syslog.collectord.io/stderr-logs-eventPatternMaxSize- (26.10+)syslog.collectord.io/stderr-logs-repeat-enabled- (26.10+)syslog.collectord.io/stderr-logs-repeat-maxspan- (26.10+)syslog.collectord.io/stderr-logs-repeat-offsets- (26.10+)syslog.collectord.io/stderr-logs-fold-enabled- (26.10+)syslog.collectord.io/stderr-logs-fold-maxperminute- (26.10+)syslog.collectord.io/stderr-logs-fold-keep- (26.10+)syslog.collectord.io/stderr-logs-escapeterminalsequencessyslog.collectord.io/stderr-logs-override.{N}-match-syslog.collectord.io/stderr-logs-override.{N}-source-syslog.collectord.io/stderr-logs-override.{N}-type-syslog.collectord.io/stderr-logs-sampling-percent-syslog.collectord.io/stderr-logs-sampling-key-syslog.collectord.io/stderr-logs-whitelist-
- Annotations for events (can be applied only to namespaces)
syslog.collectord.io/events-source- change the source for the events of specific namespacesyslog.collectord.io/events-type- change the source type for the events of specific namespacesyslog.collectord.io/events-host- change the host for the events of specific namespacesyslog.collectord.io/events-userfields.{fieldname}- attach custom fields to eventssyslog.collectord.io/events-output- (26.04.1+) change the output for the events published on the namespace
- Annotations for application logs
syslog.collectord.io/volume.{N}-logs-name- name of the volume attached to Podsyslog.collectord.io/volume.{N}-logs-output- configure the output for the logs forwarded from the volumesyslog.collectord.io/volume.{N}-logs-source- change the source for logs forwarded from the volumesyslog.collectord.io/volume.{N}-logs-type- change the type for logs forwarded from the volumesyslog.collectord.io/volume.{N}-logs-host- change the host for logs forwarded from the volumesyslog.collectord.io/volume.{N}-logs-eventpattern- change the event pattern defining new event for logs forwarded from the volumesyslog.collectord.io/volume.{N}-logs-repeat-enabled- (26.10+) send repeated lines of the volume’s logs as one event that counts themsyslog.collectord.io/volume.{N}-logs-fold-enabled- (26.10+) fold storms of alike lines in the volume’s logs (lossy)syslog.collectord.io/volume.{N}-logs-patterns-enabled- (26.10+) accepted, but a syslog output carries no pattern reportsyslog.collectord.io/volume.{N}-logs-replace.{N}-search- specify the regex search for replace pipe for the logssyslog.collectord.io/volume.{N}-logs-replace.{N}-val- specify the regex replace pattern for replace pipe for the logssyslog.collectord.io/volume.{N}-logs-hashing.{N}-match- the regexp for a matched valuesyslog.collectord.io/volume.{N}-logs-hashing.{N}-function- hash function (default issha256, availableadler-32,crc-32-ieee,crc-32-castagnoli,crc-32-koopman,crc-64-iso,crc-64-ecma,fnv-1-64,fnv-1a-64,fnv-1-32,fnv-1a-32,fnv-1-128,fnv-1a-128,md5,sha1,sha256,sha384,sha512)syslog.collectord.io/volume.{N}-logs-extraction- specify the fields extraction with the regex the logssyslog.collectord.io/volume.{N}-logs-extractionMessageField- specify the field name for the message (by default last unnamed group in regexp)syslog.collectord.io/volume.{N}-logs-timestampfield- specify the timestamp fieldsyslog.collectord.io/volume.{N}-logs-timestampformat- specify the format for timestamp fieldsyslog.collectord.io/volume.{N}-logs-timestampsetmonth- define if month should be set to current for timestampsyslog.collectord.io/volume.{N}-logs-timestampsetday- define if day should be set to current for timestampsyslog.collectord.io/volume.{N}-logs-timestamplocation- define timestamp location if not set by formatsyslog.collectord.io/volume.{N}-logs-glob- set the glob pattern for matching logssyslog.collectord.io/volume.{N}-logs-match- set the regexp pattern for matching logssyslog.collectord.io/volume.{N}-logs-recursive- set if walker should walk the directory recursivesyslog.collectord.io/volume.{N}-logs-override.{N}-match- match for override patternsyslog.collectord.io/volume.{N}-logs-override.{N}-source- override source for matched eventssyslog.collectord.io/volume.{N}-logs-override.{N}-type- override type for matched eventssyslog.collectord.io/volume.{N}-logs-sampling-percent- specify the % value of logs that should be forwarded to the syslog serversyslog.collectord.io/volume.{N}-logs-sampling-key- regexp pattern to specify the key for the sampling based on hash valuessyslog.collectord.io/volume.{N}-logs-ThruputPerSecond- set the thruput for this container, maximum amount of logs per second, for example128Kb,1024bsyslog.collectord.io/volume.{N}-logs-TooOldEvents- duration of events from now to past that are considered too old and should be ignored, for example168h,24hsyslog.collectord.io/volume.{N}-logs-TooNewEvents- duration of events from now to the future that are considered too new and should be ignored, for example1h,30msyslog.collectord.io/volume.{N}-logs-whitelist- allow to configure pattern for log messages, only log messages matching this pattern will be forwardedsyslog.collectord.io/volume.{N}-logs-userfields.{fieldname}- attach custom fields to eventssyslog.collectord.io/volume.{N}-logs-maxholdafterclose- how long Collectord can hold file descriptors open for files in PVC after pod is terminated (duration5s,1800s)syslog.collectord.io/volume.{N}-logs-onvolumedatabase- (5.20.400+) boolean flag to enable on volume database for this volume, in case if this volume might be used on more than one hostsyslog.collectord.io/volume.{N}-logs-withlock- (5.24.440+) boolean flag to enable file locking of forwarding logs from the files, and preventing other Collectord instances to read the file