<p>i wan't to send pod log to ELK, buat after deploying fluentd i get Error, i got from tutorial Official Fluentd documentation</p>
<p>EKS Version 1.22</p>
<p>i put Suppress_Type_Name On, it's not solved this issue</p>
<pre><code>[2022/06/20 16:23:07] [error] [output:es:es.0] HTTP status=400 URI=/_bulk, response:
{&quot;error&quot;:{&quot;root_cause&quot;:[{&quot;type&quot;:&quot;illegal_argument_exception&quot;,&quot;reason&quot;:&quot;Action/metadata line [1] contains an unknown parameter [_type]&quot;}],&quot;type&quot;:&quot;illegal_argument_exception&quot;,&quot;reason&quot;:&quot;Action/metadata line [1] contains an unknown parameter [_type]&quot;},&quot;status&quot;:400}
</code></pre>
<p>my configmap</p>
<pre><code>  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020

    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE output-elasticsearch.conf

  input-kubernetes.conf: |
    [INPUT]
        Name              tail
        Tag               kube.*
        Path              /var/log/containers/*.log
        Parser            docker
        DB                /var/log/flb_kube.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10

  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off

  output-elasticsearch.conf: |
    [OUTPUT]
        Name            es
        Match           *
        Host            ${FLUENT_ELASTICSEARCH_HOST}
        Port            ${FLUENT_ELASTICSEARCH_PORT}
        Logstash_Format On
        Replace_Dots    On
        Retry_Limit     False
</code></pre>

<p>I was able to resolve the issue by these 3 steps,</p>
<p>step 1. You need to update your fluentbit image to latest</p>
<blockquote>
<pre><code>    image: fluent/fluent-bit:2.1.1
</code></pre>
</blockquote>
<p>You can get the deployment file from <a href="https://docs.fluentbit.io/manual/v/1.5/installation/kubernetes" rel="nofollow noreferrer">here</a></p>
<p>step 2: Add &quot;Suppress_Type_Name On&quot; to output-elasticsearch.conf</p>
<pre><code>  output-elasticsearch.conf: |
    [OUTPUT]
        Name            es
        Match           *
        Host            ${FLUENT_ELASTICSEARCH_HOST}
        Port            ${FLUENT_ELASTICSEARCH_PORT}
        HTTP_User       ${FLUENT_ELASTICSEARCH_USER}
        HTTP_Passwd     ${FLUENT_ELASTICSEARCH_PASSWORD}
        Logstash_Format On
        Replace_Dots    On
        Retry_Limit     False
        Suppress_Type_Name On
</code></pre>
<p>Step 3. Delete the fluentbit pods and reapply it</p>
<pre><code>kubectl delete -f fluentbit-ds.yaml
kubectl apply -f fluentbit-ds.yaml
</code></pre>
