Skip to main content

Collect Specific Application Logs

Focus on logs from specific applications using namespace and label selectors.

Pipeline​

input:
  subprocess:
    name: oc
    args:
      - logs
      - --namespace=production
      - --all-containers=true
      - --prefix=true
      - --follow
      - --selector=app=point-of-sale
    codec: lines
    restart_on_exit: true

pipeline:
  processors:
    - mapping: |
        # Parse and structure logs
        root = this.parse_json().catch({
          "message": this,
          "level": "info"
        })
        root.cluster = env("CLUSTER_NAME")
        root.location = env("LOCATION")
        root.app = "point-of-sale"
        root.timestamp = now()

output:
  broker:
    pattern: fan_out
    outputs:
      # Real-time to Elasticsearch
      - elasticsearch_v2:
          urls: ['https://elasticsearch.company.com:9200']
          index: 'sno-pos-logs-${! timestamp_unix("2006-01-02") }'
          batching:
            count: 100
            period: 10s

      # Archive to S3
      - aws_s3:
          bucket: sno-app-logs
          path: 'pos/${! env("CLUSTER_NAME") }/${! timestamp_unix() }.jsonl'
          batching:
            count: 5000
            period: 10m

What This Does​

  • Namespace filtering: Only collects from production namespace
  • Label selector: Only pods with app=point-of-sale label
  • JSON parsing: Attempts to parse structured logs, falls back to plain text
  • Dual destination: Real-time search in Elasticsearch, long-term archive in S3
  • Different batching: Fast (10s) for Elasticsearch, slower (10m) for S3

Label Selectors​

Single label:

--selector=app=point-of-sale

Multiple labels (AND):

--selector=app=point-of-sale,tier=frontend

Multiple values (OR):

--selector=app in (point-of-sale,inventory)

Exclude labels:

--selector=app=point-of-sale,tier!=backend

Use Cases​

Production monitoring: Only collect production app logs, ignore dev/test

Specific application: Focus on critical business application (POS, inventory, etc.)

Multi-tenant: Separate pipelines per tenant/customer namespace

Compliance: Collect logs only from applications with compliance requirements

Multiple Application Pipelines​

Run separate pipelines for different applications:

pos-logs.yaml:

input:
  subprocess:
    name: oc
    args: [logs, --namespace=production, --selector=app=point-of-sale, --follow]
output:
  aws_s3:
    bucket: pos-logs

inventory-logs.yaml:

input:
  subprocess:
    name: oc
    args: [logs, --namespace=production, --selector=app=inventory, --follow]
output:
  aws_s3:
    bucket: inventory-logs

Dynamic Configuration​

Use environment variables for flexible deployment:

input:
  subprocess:
    name: oc
    args:
      - logs
      - --namespace=${NAMESPACE}
      - --selector=${LABEL_SELECTOR}
      - --follow

Set per deployment:

export NAMESPACE=production
export LABEL_SELECTOR="app=point-of-sale"

Next Steps​