Kubernetes logs format in Splunk

3/22/2020

I am new to kubernetes and splunk. I have a Django application named myapp which is deployed in Kubernetes. I am using Celery for tasks scheduling.

The logs I am getting from Kubernetes in Splunk are in the following format:-

log: {"event": "event name", "timestamp": "2020-03-19T20:52:01.221759Z", "logger": "myapp.tasks", "level": "info"}

I want the above logs to be formatted in the following manner:-

line: { [-]
     event: event name
     level: info
     logger: myapp.tasks
     timestamp: 2020-03-19T20:51:08.800947Z
   }

I read Forwarding logs from kubernetes to splunk post but could not find /etc/docker/daemon.json file.

Please let me know if there is any library or way with which I can get the formatted kubernetes logs in splunk. I would like to know if this can be done from myapp application.

-- mesh
format
kubernetes
logging
splunk

0 Answers