A Kubernetes label is a key-value attribute attached to a resource for identification, organization, and selection. For container-log enrichment, labels belong to the metadata Fluent Bit obtains for a Pod, alongside its ID, annotations, namespace labels, and namespace annotations. The Kubernetes filter can then incorporate that metadata into each matching log event. section 4.6.4
Fluent Bit running as a DaemonSet reads container stdout and stderr logs from each node. It derives a Pod name, namespace, container name, and container ID from the log path and tag, then queries the Kubernetes API server or kubelet for Pod metadata. Standard Kubernetes log-path conventions, or a parser that understands an alternative path format, are necessary to recover the identifying fields used for this lookup. section 4.6.4
Configure label enrichment as part of the Kubernetes filter pipeline:
- Match the filter against Kubernetes log tags, such as kube.*. section 4.6.4
- Connect securely to the Kubernetes API with the service-account CA certificate and token, or use a kubelet endpoint when appropriate. section 4.6.4
- Set labels on to add labels and annotations on when annotation metadata is also needed. section 4.6.4
- Set a metadata cache TTL to control reuse of retrieved Kubernetes metadata. section 4.6.4
- Use merge_log options separately when application log content should be merged or retained under a chosen key. section 4.6.4
Enable Pod-label enrichment
A Kubernetes filter matching kube.* can use the in-cluster API URL, service-account credentials, a 60-second metadata cache, and labels on. With the tag prefix aligned to Kubernetes container log paths, Fluent Bit can identify the workload and attach its retrieved metadata to the event. section 4.6.4
Listing 4.7 Kubernetes filter fragment: kubernetes-filter.conf
[FILTER] name kubernetes match kube.* #1 kube_URL https://kubernetes.default.svc:443 #2 kube_CA_file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt #3 kube_token_file /var/run/secrets/kubernetes.io/serviceaccount/token #3 kube_meta_cache_TTL 60s #4 cache_use_docker_id on labels on #5 annotations on #5 use_journal off kube_tag_prefix kube.var.log.containers. #6 merge_log on merge_log_key log_processed merge_log_trim on #7
The filter fragment shows the operational settings for API authentication, caching, tag parsing, label and annotation inclusion, and log merging. section 4.6.4
Prometheus also uses the word “label” for name-value dimensions on metrics, but that is a separate use from Kubernetes resource labels. Prometheus labels support grouping and later querying by deployment, server, or fleet characteristics; their names have strict character rules, and excessive cardinality can affect Prometheus. section 5.6.1
