title: containerd multiline logs parsing with fluentbit
body: <p>After shifting from Docker to containerd as docker engine used by our kubernetes, we are not able to show the multiline logs in a proper way by our visualization app (Grafana) as some details prepended to the container/pod logs by the containerd itself (i.e. timestamp, stream &amp; log severity to be specific it is appending something like the following and as shown in the below sample: <strong>2022-07-25T06:43:17.20958947Z stdout F</strong>  ) which make some confusion for the developers and the application owners.</p>
  <p>I am showing here a dummy sample of the logs generated by the application and how it got printed in the nodes of kuberenetes'nodes after containerd prepended the mentioned details.</p>
  <p>The following logs generated by the application (kubectl logs ):</p>
  <pre><code>2022-07-25T06:43:17,309ESC[0;39m dummy-[txtThreadPool-2] ESC[39mDEBUGESC[0;39m
    ESC[36mcom.pkg.sample.ComponentESC[0;39m - Process message meta {
    timestamp: 1658731397308720468
    version {
        major: 1
        minor: 0
        patch: 0
    }
  }
  </code></pre>
  <p>when I check the logs in the filesystem (/var/log/container/ABCXYZ.log) :</p>
  <pre><code>2022-07-25T06:43:17.20958947Z stdout F 2022-07-25T06:43:17,309ESC[0;39m dummy-[txtThreadPool-2]
  ESC[39mDEBUGESC[0;39m
  ESC[36mcom.pkg.sample.ComponentESC[0;39m - Process message meta {
  2022-07-25T06:43:17.20958947Z stdout F timestamp: 1658731449723010774
  2022-07-25T06:43:17.209593379Z stdout F version {
  2022-07-25T06:43:17.209595933Z stdout F major: 14
  2022-07-25T06:43:17.209598466Z stdout F minor: 0
  2022-07-25T06:43:17.209600712Z stdout F patch: 0
  2022-07-25T06:43:17.209602926Z stdout F }
  2022-07-25T06:43:17.209605099Z stdout F }
  </code></pre>
  <p>I am able to parse the multiline logs with fluentbit but the problem is I am not able to remove the details injected by containerd ( &gt;&gt; 2022-07-25T06:43:17.209605099Z stdout F .......). So is there anyway to configure containerd to not prepend these details somehow in the logs and print them as they are generated from the application/container ?</p>
  <p>On the other hand is there any plugin to remove such details from fluentbit side .. as per the existing <a href="https://docs.fluentbit.io/manual/concepts/data-pipeline" rel="nofollow noreferrer">plugins</a> none of them can manipulate or change the logs (which is logical  as the log agent should not do any change on the logs).</p>
  <p>Thanks in advance.</p>