1. Documentation
×

Log Record Fields

The following fields can be present in log records exported by the logging subsystem. Although log records are typically formatted as JSON objects, the same data model can be applied to other encodings.

To search these fields from Elasticsearch and Kibana, use the full dotted field name when searching. For example, with an Elasticsearch /_search URL, to look for a Kubernetes pod name, use /_search/q=kubernetes.pod_name:name-of-my-pod.

The top level fields may be present in every record.

message

The original log entry text, UTF-8 encoded. This field may be absent or empty if a non-empty structured field is present. See the description of structured for more.

Data type

text
Example value

HAPPY

structured

Original log entry as a structured object. This field may be present if the forwarder was configured to parse structured JSON logs. If the original log entry was a valid structured log, this field will contain an equivalent JSON structure. Otherwise this field will be empty or absent, and the message field will contain the original log message. The structured field can have any subfields that are included in the log message, there are no restrictions defined here.

Data type

group
Example value

map[message:starting fluentd worker pid=21631 ppid=21618 worker=0 pid:21631 ppid:21618 worker:0]

@timestamp

A UTC value that marks when the log payload was created or, if the creation time is not known, when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. By default, most tools look for “@timestamp” with ElasticSearch.

Data type

date
Example value

2015-01-24 14:06:05.071000000 Z

hostname

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

Data type

keyword

ipaddr4

The IPv4 address of the source server. Can be an array.

Data type

ip

ipaddr6

The IPv6 address of the source server, if available. Can be an array.

Data type

ip

level

The logging level from various sources, including rsyslog(severitytext property), a Python logging module, and others.

The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages.

The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn’t recognize.

Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

Data type

keyword
Example value

info

pid

The process ID of the logging entity, if available.

Data type

keyword

service

The name of the service associated with the logging entity, if available. For example, syslog’s APP-NAME and rsyslog’s programname properties are mapped to the service field.

Data type

keyword

tags

Optional. An operator-defined list of tags placed on each log by the collector or normalizer. The payload can be a string with whitespace-delimited string tokens or a JSON list of string tokens.

Data type

text

file

The path to the log file from which the collector reads this log entry. Normally, this is a path in the /var/log file system of a cluster node.

Data type

text

offset

The offset value. Can represent bytes to the start of the log line in the file (zero- or one-based), or log line numbers (zero- or one-based), so long as the values are strictly monotonically increasing in the context of a single log file. The values are allowed to wrap, representing a new version of the log file (rotation).

Data type

long

kubernetes

The namespace for Kubernetes-specific metadata

Data type

group

kubernetes.pod_name

The name of the pod

Data type

keyword

kubernetes.pod_id

The Kubernetes ID of the pod

Data type

keyword

kubernetes.namespace_name

The name of the namespace in Kubernetes

Data type

keyword

kubernetes.namespace_id

The ID of the namespace in Kubernetes

Data type

keyword

kubernetes.host

The Kubernetes node name

Data type

keyword

kubernetes.container_name

The name of the container in Kubernetes

Data type

keyword

kubernetes.annotations

Annotations associated with the Kubernetes object

Data type

group

kubernetes.labels

Labels present on the original Kubernetes Pod

Data type

group

kubernetes.event

The Kubernetes event obtained from the Kubernetes master API. This event description loosely follows type Event in Event v1 core.

Data type

group

kubernetes.event.verb

The type of event, ADDED, MODIFIED, or DELETED

Data type

keyword
Example value

ADDED

kubernetes.event.metadata

Information related to the location and time of the event creation

Data type

group
kubernetes.event.metadata.name

The name of the object that triggered the event creation

Data type

keyword
Example value

java-mainclass-1.14d888a4cfc24890
kubernetes.event.metadata.namespace

The name of the namespace where the event originally occurred. Note that it differs from kubernetes.namespace_name, which is the namespace where the eventrouter application is deployed.

Data type

keyword
Example value

default

A link to the event

Data type

keyword
Example value

/api/v1/namespaces/javaj/events/java-mainclass-1.14d888a4cfc24890
kubernetes.event.metadata.uid

The unique ID of the event

Data type

keyword
Example value

d828ac69-7b58-11e7-9cf5-5254002f560c
kubernetes.event.metadata.resourceVersion

A string that identifies the server’s internal version of the event. Clients can use this string to determine when objects have changed.

Data type

integer
Example value

311987

kubernetes.event.involvedObject

The object that the event is about.

Data type

group
kubernetes.event.involvedObject.kind

The type of object

Data type

keyword
Example value

ReplicationController
kubernetes.event.involvedObject.namespace

The namespace name of the involved object. Note that it may differ from kubernetes.namespace_name, which is the namespace where the eventrouter application is deployed.

Data type

keyword
Example value

default
kubernetes.event.involvedObject.name

The name of the object that triggered the event

Data type

keyword
Example value

java-mainclass-1
kubernetes.event.involvedObject.uid

The unique ID of the object

Data type

keyword
Example value

e6bff941-76a8-11e7-8193-5254002f560c
kubernetes.event.involvedObject.apiVersion

The version of kubernetes master API

Data type

keyword
Example value

v1
kubernetes.event.involvedObject.resourceVersion

A string that identifies the server’s internal version of the pod that triggered the event. Clients can use this string to determine when objects have changed.

Data type

keyword
Example value

308882

kubernetes.event.reason

A short machine-understandable string that gives the reason for generating this event

Data type

keyword
Example value

SuccessfulCreate

kubernetes.event.source_component

The component that reported this event

Data type

keyword
Example value

replication-controller

kubernetes.event.firstTimestamp

The time at which the event was first recorded

Data type

date
Example value

2017-08-07 10:11:57.000000000 Z

kubernetes.event.count

The number of times this event has occurred

Data type

integer
Example value

1

kubernetes.event.type

The type of event, Normal or Warning. New types could be added in the future.

Data type

keyword
Example value

Normal

OpenShift

The namespace for openshift-logging specific metadata

Data type

group

openshift.labels

Labels added by the Cluster Log Forwarder configuration

Data type

group