<p>I'm trying to collect logs using FluentD and I'm getting following error;</p>
<pre><code>2021-08-31 05:37:03 +0000 [warn]: #0 [tail_container_logs] pattern not match: &quot;2021-08-31T05:37:03.133785104Z stderr F I0831 05:37:03.130864       1 main.go:227] handling current node&quot;
2021-08-31 05:37:06 +0000 [warn]: #0 [tail_container_logs] pattern not match: &quot;2021-08-31T05:37:05.474234466Z stdout F Hello world&quot;
2021-08-31 05:37:08 +0000 [warn]: #0 [tail_container_logs] pattern not match: &quot;2021-08-31T05:37:07.195447969Z stderr F 2021-08-31 05:37:07.195301 I | etcdserver/api/etcdhttp: /health OK (status code 200)&quot;
</code></pre>
<p>My fluent.conf file is as follows;</p>
<pre><code>&lt;source&gt;
  @type tail
  @id tail_container_logs
  path /var/log/containers/*.log
  pos_file /var/fluent/log/containers.log.pos
  time_format %Y-%m-%dT%H:%M:%S.%NZ
  tag kubernetes.*
  exclude_path &quot;/var/log/containers/my-fluent*.log&quot;
  read_from_head true
  &lt;parse&gt;
    @type json
    time_format %Y-%m-%dT%H:%M:%S.%NZ
  &lt;/parse&gt;
&lt;/source&gt;

&lt;filter kubernetes.**&gt;
  @type kubernetes_metadata
&lt;/filter&gt;

&lt;match kubernetes.**&gt;
  @type file
  @id   output1
  path         /var/fluent/log/log/data.*.log
  append       true
&lt;/match&gt;
</code></pre>
<p>When I check the Docker logging driver configuration on the host (not on kubernetes nodes) where the kind kubernetes cluster runs, it shows json-file as the logging driver.</p>
<p>However I couldn't find the logging driver configuration in the node for CRI. When I connected to the node and ran the <code>crictl info</code> it shows the configuration but there was no logging driver. After further investigation I found cri-o logging has no json support. I suspect only option available is to use @type regex in FluentD  configuration.</p>
<p>Any suggestion on how to parse the cri-o logs in fluentD?</p>
<p>Thanks in advance!!!</p>

Jason Nanay
<p>I was able to get the cri-o logs parsed using regex found in <a href="https://github.com/fluent/fluent-bit/issues/522" rel="nofollow noreferrer">fluent-bit</a> topic. Here is the fluentD configuration of the  part.</p>
<pre><code>&lt;source&gt;
  @type tail
  @id tail_container_logs
  path /var/log/containers/*.log
  pos_file /var/fluent/log/containers.log.pos
  time_format %Y-%m-%dT%H:%M:%S.%NZ
  tag kubernetes.*
  exclude_path &quot;/var/log/containers/my-fluent*.log&quot;
  #format json_in_json
  read_from_head true
  &lt;parse&gt;
    @type regexp
    expression /^(?&lt;time&gt;.+)\b(?&lt;stream&gt;stdout|stderr)\b(?&lt;log&gt;.*)$/
    time_key time
    time_format %Y-%m-%dT%H:%M:%S.%NZ
  &lt;/parse&gt;
&lt;/source&gt;
</code></pre>
<p>Currently there is no cri-o parser for FluentD</p>
