<p>I have setup EFK stack in K8s cluster. Currently fluentd is <strong>scraping</strong> logs from all the containers.</p>
<p>I want it to only scrape logs from containers <code>A</code>, <code>B</code>, <code>C</code> and <code>D</code>.</p>
<p>If I had some prefix with as <code>A-app</code> I could do something like below.</p>
<pre><code>&quot;fluentd-inputs.conf&quot;: &quot;# HTTP input for the liveness and readiness probes
        &lt;source&gt;
          @type http
          port 9880
        &lt;/source&gt;
        # Get the logs from the containers running in the node
        &lt;source&gt;
          @type tail
          path /var/log/containers/*-app.log // what can I put here for multiple different containers
          # exclude Fluentd logs
          exclude_path /var/log/containers/*fluentd*.log
          pos_file /opt/bitnami/fluentd/logs/buffers/fluentd-docker.pos
          tag kubernetes.*
          read_from_head true
          &lt;parse&gt;
            @type json
          &lt;/parse&gt;
        &lt;/source&gt;
        # enrich with kubernetes metadata
        &lt;filter kubernetes.**&gt;
          @type kubernetes_metadata
        &lt;/filter&gt;
</code></pre>

<p>To scrape logs only from specific Pods, you can use:</p>
<pre><code>path /var/log/containers/POD_NAME_1*.log,/var/log/containers/POD_NAME_2*.log,.....,/var/log/containers/POD_NAME_N*.log
</code></pre>
<p>To scrape logs from specific containers in specific Pods, you can use:</p>
<pre><code>path /var/log/containers/POD_NAME_1*CONTAINER_NAME*.log,/var/log/containers/POD_NAME_2*CONTAINER_NAME*.log,.....,/var/log/containers/POD_NAME_N*CONTAINER_NAME*.log
</code></pre>
<hr />
<p>I've created a simple example to illustrate how it works.</p>
<p>To scrape logs from <code>web-1</code> container from <code>app-1</code> Pod and logs from all containers from <code>app-2</code> Pod, you can use:</p>
<pre><code>path /var/log/containers/app-1*web-1*.log,/var/log/containers/app-2*.log



$ kubectl logs -f fluentd-htwn5
...
2021-08-20 13:37:44 +0000 [info]: #0 starting fluentd worker pid=18 ppid=7 worker=0
2021-08-20 13:37:44 +0000 [info]: #0 [in_tail_container_logs] following tail of /var/log/containers/app-1_default_web-1-ae672aa1405b91701d130da34c54ab3106a8fc4901897ebbf574d03d5ca64eb8.log
2021-08-20 13:37:44 +0000 [info]: #0 [in_tail_container_logs] following tail of /var/log/containers/app-2-64c99b9f5b-tm6ck_default_nginx-cd1bd7617f04000a8dcfc1ccd01183eafbce9d0155578d8818b27427a4062968.log
2021-08-20 13:37:44 +0000 [info]: #0 [in_tail_container_logs] following tail of /var/log/containers/app-2-64c99b9f5b-tm6ck_default_frontend-1-e83acc9e7fc21d8e3c8a733e10063f44899f98078233b3238d6b3dc0903db560.log
2021-08-20 13:37:44 +0000 [info]: #0 fluentd worker is now running worker=0
...
</code></pre>
