<p>This is one that works when using single tail input</p>
<pre><code>inputs: |
    [INPUT]
        Name    tail
        Tag     kube.*
        Path    /var/log/containers/*.log
        Parser  docker

  filters: |
    [FILTER]
        Name             kubernetes
        Match            *
        Kube_URL         https://kubernetes.default.svc:443
        Kube_CA_File     /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File  /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix  kube.var.log.containers.
        Merge_Log        On
        Merge_Log_Key    log_processed
    [FILTER]
        Name    Lua
        Match   kube.*
        code    function dummy_filter(a,b,c)local n=c;n[&quot;dummy&quot;]=&quot;dummy&quot;;return 2,b,n end
        call    dummy_filter
    [FILTER]
        Name             parser
        Match            kube.*
        Key_Name         log
        Parser           tomcat_parser
        Preserve_Key     On
        Reserve_Data     On
    [FILTER]
        Name    Lua
        Match   kube.*
        code    function dummy_filter1(a,b,c)local n=c;n[&quot;dummy1&quot;]=&quot;dummy1&quot;;return 2,b,n end
        call    dummy_filter1

  customParsers: |
    [PARSER]
       Format regex
       Name   tomcat_parser
       Regex  ^(?&lt;apptime&gt;[0-9-a-zA-Z]+\s[0-9:\.]+)\s+(?&lt;level&gt;[a-zA-Z]+)\s+\[(?&lt;thread&gt;[a-zA-Z]+)\]\s+(?&lt;applog&gt;.*$)

  outputs: |
    [OUTPUT]
        Name              cloudwatch_logs
        Match             kube.*
        Region            ${region}
        Log_Group_Name    /myapps/logs
        Log_Stream_Prefix my
        Auto_Create_Group On
        net.keepalive     Off
</code></pre>
<p>And this doesn't work. final output in /myapps/tomcatlogs has data from all the 3 remaining filters except from the kubernetes.</p>
<pre><code>inputs: |
    [INPUT]
        Name    tail
        Tag     kube.*
        Path    /var/log/containers/*.log
        Parser  docker
    [INPUT]
        Name    tail
        Tag     tomcat.*
        Path    /var/log/containers/tomcat*.log. (checked even *.log doesn't work)
        Parser  docker

  filters: |
    [FILTER]
        Name             kubernetes
        Match            *
        Kube_URL         https://kubernetes.default.svc:443
        Kube_CA_File     /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File  /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix  kube.var.log.containers.
        Merge_Log        On
        Merge_Log_Key    log_processed
    [FILTER]
        Name    Lua
        Match   tomcat.*
        code    function dummy_filter(a,b,c)local n=c;n[&quot;dummy&quot;]=&quot;dummy&quot;;return 2,b,n end
        call    dummy_filter
    [FILTER]
        Name             parser
        Match            tomcat.*
        Key_Name         log
        Parser           tomcat_parser
        Preserve_Key     On
        Reserve_Data     On
    [FILTER]
        Name    Lua
        Match   tomcat.*
        code    function dummy_filter1(a,b,c)local n=c;n[&quot;dummy1&quot;]=&quot;dummy1&quot;;return 2,b,n end
        call    dummy_filter1

  customParsers: |
    [PARSER]
       Format regex
       Name   tomcat_parser
       Regex  ^(?&lt;apptime&gt;[0-9-a-zA-Z]+\s[0-9:\.]+)\s+(?&lt;level&gt;[a-zA-Z]+)\s+\[(?&lt;thread&gt;[a-zA-Z]+)\]\s+(?&lt;applog&gt;.*$)

  outputs: |
    [OUTPUT]
        Name              cloudwatch_logs
        Match             kube.*
        Region            ${region}
        Log_Group_Name    /myapps/logs
        Log_Stream_Prefix my
        Auto_Create_Group On
        net.keepalive     Off
    [OUTPUT]
        Name              cloudwatch_logs
        Match             tomcat.*
        Region            ${region}
        Log_Group_Name    /myapps/tomcatlogs
        Log_Stream_Prefix my
        Auto_Create_Group On
        net.keepalive     Off
</code></pre>
<p>I don't like the existing sol as non-tomcat logs too gets evaluated in the tomcat filter.
Any guidance will be appreciated.</p>

S Kr
<p>Your tomcat Input tag the records as tomcat.* which means that they will managed as:</p>
<pre><code>tomcat.var.log.containers.tomcat*.log
</code></pre>
<p>And your kubernetes filter has</p>
<pre><code>Kube_Tag_Prefix   kube.var.log.containers.
</code></pre>
<p>So the tomcat tagged records won fit the kube tag prefix and so it won't be able to parse correctly the log files names.
You can set the Log_level as debug for fluent-bit inside the [SERVICE]. This will give you a more detail information about what is happening.</p>
<p>Hope this helps!</p>
