<p>I have deployed the Bitnami EFK helm chart on the K8s cluster.
<strong><a href="https://github.com/bitnami/charts/tree/master/bitnami/fluentd" rel="nofollow noreferrer">https://github.com/bitnami/charts/tree/master/bitnami/fluentd</a></strong></p>
<p>All pod runs fine but Fluentd not showing any logs. I don't know if I have something missing in the config. However, the cluster is restricted, and don't know if that makes any difference. I deployed the same EFK on the unrestricted cluster with the same configuration and works totally fine.</p>
<pre><code>kkot@ltp-str-00-0085:~/logging-int$ kk get pod
NAME                                                             READY   STATUS    RESTARTS   AGE
elasticsearch-elasticsearch-coordinating-only-5f5656cdd5-9d4lj   1/1     Running   0          6h34m
elasticsearch-elasticsearch-coordinating-only-5f5656cdd5-h6lbd   1/1     Running   0          6h34m
elasticsearch-elasticsearch-data-0                               1/1     Running   0          6h34m
elasticsearch-elasticsearch-data-1                               1/1     Running   0          6h34m
elasticsearch-elasticsearch-master-0                             1/1     Running   0          6h34m
elasticsearch-elasticsearch-master-1                             1/1     Running   0          6h34m
fluentd-0                                                        1/1     Running   0          6h10m
fluentd-4glgs                                                    1/1     Running   2          6h10m
fluentd-59tzz                                                    1/1     Running   0          5h43m
fluentd-b8bc8                                                    1/1     Running   2          6h10m
fluentd-qfdcs                                                    1/1     Running   2          6h10m
fluentd-sf2hk                                                    1/1     Running   2          6h10m
fluentd-trvwx                                                    1/1     Running   0          95s
fluentd-tzqw8                                                    1/1     Running   2          6h10m
kibana-656d55f94d-8qf8f                                          1/1     Running   0          6h28m



kkot@ltp-str-00-0085:~/logging-int$ kk logs fluentd-qfdcs
</code></pre>
<p>Error Log:</p>
<pre><code>2021-02-24 10:52:15 +0000 [warn]: #0 pattern not matched: &quot;{\&quot;log\&quot;:\&quot;2021-02-24 10:52:13 +0000 [warn]: #0 pattern not matched: \\&quot;{\\\\&quot;log\\\\&quot;:\\\\&quot;
</code></pre>
<p>Has anyone faced the same issue? Thanks</p>

kishorK
<p>Could you please share what configuration is your forwarder using?</p>
<p>In the latest version of the chart (3.6.2) it will use the following by default:</p>
<pre><code>  configMapFiles:
    fluentd.conf: |
      # Ignore fluentd own events
      &lt;match fluent.**&gt;
        @type null
      &lt;/match&gt;
      @include fluentd-inputs.conf
      @include fluentd-output.conf
      {{- if .Values.metrics.enabled }}
      @include metrics.conf
      {{- end }}
    fluentd-inputs.conf: |
      # HTTP input for the liveness and readiness probes
      &lt;source&gt;
        @type http
        port 9880
      &lt;/source&gt;
      # Get the logs from the containers running in the node
      &lt;source&gt;
        @type tail
        path /var/log/containers/*.log
        # exclude Fluentd logs
        exclude_path /var/log/containers/*fluentd*.log
        pos_file /opt/bitnami/fluentd/logs/buffers/fluentd-docker.pos
        tag kubernetes.*
        read_from_head true
        &lt;parse&gt;
          @type json
        &lt;/parse&gt;
      &lt;/source&gt;
      # enrich with kubernetes metadata
      &lt;filter kubernetes.**&gt;
        @type kubernetes_metadata
      &lt;/filter&gt;
</code></pre>
<p>By the error log you shared:</p>
<pre><code>2021-02-24 10:52:15 +0000 [warn]: #0 pattern not matched: &quot;{\&quot;log\&quot;:\&quot;2021-02-24 10:52:13 +0000 [warn]: #0 pattern not matched: \\&quot;{\\\\&quot;log\\\\&quot;:\\\\&quot;
</code></pre>
<p>I notice two things:</p>
<ul>
<li>The fluentd pods seem to be collecting their own logs, which shouldn't be happening because of:
<blockquote>
<pre><code>   # exclude Fluentd logs
   exclude_path /var/log/containers/*fluentd*.log
</code></pre>
</blockquote>
</li>
<li>The JSON logs are not being parsed although it is configured:
<blockquote>
<pre><code>    &lt;parse&gt;
       @type json
    &lt;/parse&gt;
</code></pre>
</blockquote>
</li>
</ul>
<p>Maybe you have omitted the configMapFiles in your <code>values.yaml</code>?</p>
