How to use fluentd+elasticsearch+grafana to display the first 12 characters of the container ID?

5/6/2019

Need to use fluentd to collect logs of kubernets and store logs in elasticsearch. And use grafana to display logs and digests. However, the docker's container id is 64 characters. How to set the fluentd, or elasticsearch, or grafana, to display just first 12-character of container id in grafana?

my config file as follow: https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml

-- Yang Hit
fluentd
kubernetes

1 Answer

5/6/2019

Try something like this at the end of containers.input.conf:

<filter kubernetes.**>
  @type record_transformer
  enable_ruby
  <record>
    docker.container_id ${record["docker.container_id"][0,12]}
  </record>
</filter>
-- Vasily Angapov
Source: StackOverflow