<p>I'm trying to enable efk in my kubernetes cluster. I find a file about fluentd's config: <a href="https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml</a> </p>

<p>In this file, there's:</p>

<pre><code>&lt;filter kubernetes.**&gt;
  @id filter_kubernetes_metadata
  @type kubernetes_metadata
&lt;/filter&gt;
# Fixes json fields in Elasticsearch
&lt;filter kubernetes.**&gt;
  @id filter_parser
  @type parser
  key_name log
  reserve_data true
  remove_key_name_field true
  &lt;parse&gt;
    @type multi_format
    &lt;pattern&gt;
      format json
    &lt;/pattern&gt;
    &lt;pattern&gt;
      format none
    &lt;/pattern&gt;
  &lt;/parse&gt;
&lt;/filter&gt;
</code></pre>

<p>I want to use different parsers for different deployments. So I wonder:</p>

<ol>
<li><p>what's 'kubernetes.**' in kubernetes? Is it the name of a deployment or label of a deployment? </p></li>
<li><p>In docker-compose file, we can tag on different containers and use the tag in fluentd's 'filter'. In kubernetes, is there any similar way?</p></li>
</ol>

<p>Thanks for your help!</p>

<p>It isn't related to kubernetes, or to deployments; it is <code>fluentd</code> syntax that represents the top-level <code>kubernetes</code> "tag" and all its subkeys that are published as an event, as one can see <a href="https://github.com/fabric8io/fluent-plugin-kubernetes_metadata_filter#example-inputoutput" rel="nofollow noreferrer">here</a></p>
