<p>I have configured EFK stack with Fluent-bit on my Kubernetes cluster. I can see the logs in Kibana.</p>

<p>I also have deployed nginx pod, I can see the logs of this nginx pod also in Kibana. But all the log data are sent to a single field "log" as shown below.</p>

<p><a href="https://i.stack.imgur.com/llL9t.png" rel="noreferrer"><img src="https://i.stack.imgur.com/llL9t.png" alt="enter image description here"></a></p>

<p>How can I extract each field into a separate field. There is a solution for fluentd already in this question. <a href="https://stackoverflow.com/questions/42270621/kibana-how-to-extract-fields-from-existing-kubernetes-logs">Kibana - How to extract fields from existing Kubernetes logs</a></p>

<p>But how can I achieve the same with fluent-bit?</p>

<p>I have tried the below by adding one more FILTER section under the default FILTER section for Kubernetes, but it didn't work.</p>

<blockquote>
<pre><code>[FILTER]
    Name                parser
    Match               kube.*
    Key_name            log
    Parser              nginx
</code></pre>
</blockquote>

<p>From this (<a href="https://github.com/fluent/fluent-bit/issues/723" rel="noreferrer">https://github.com/fluent/fluent-bit/issues/723</a>), I can see there is no grok support for fluent-bit.</p>

<p>In our official documentation for Kubernetes filter we have an example about how to make your Pod suggest a parser for your data based in an annotation:</p>

<p><a href="https://docs.fluentbit.io/manual/filter/kubernetes" rel="noreferrer">https://docs.fluentbit.io/manual/filter/kubernetes</a></p>
