From a951e7d9a0716898de0b0b71cc574089dbf654fd Mon Sep 17 00:00:00 2001
From: Stefan Reimer <stefan@zero-downtime.net>
Date: Wed, 7 Oct 2020 09:09:24 -0700
Subject: [PATCH] New Lua function to nest entries into kube.<namespace>.*

---
 charts/kubezero-logging/Chart.yaml  |  2 +-
 charts/kubezero-logging/values.yaml | 28 ++++++++++++++++++++++------
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/charts/kubezero-logging/Chart.yaml b/charts/kubezero-logging/Chart.yaml
index db122bb7..a9431a99 100644
--- a/charts/kubezero-logging/Chart.yaml
+++ b/charts/kubezero-logging/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-logging
 description: KubeZero Umbrella Chart for complete EFK stack
 type: application
-version: 0.4.0
+version: 0.4.1
 appVersion: 1.2.1
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
diff --git a/charts/kubezero-logging/values.yaml b/charts/kubezero-logging/values.yaml
index f6823ffc..5d7226f1 100644
--- a/charts/kubezero-logging/values.yaml
+++ b/charts/kubezero-logging/values.yaml
@@ -238,6 +238,12 @@ fluent-bit:
           Emitter_Name kube_tag_rewriter
           Rule logtag F kube.$kubernetes['namespace_name'].$kubernetes['container_name'] false
 
+      [FILTER]
+          Name    lua
+          Match   kube.*
+          script  /fluent-bit/etc/functions.lua
+          call    nest_k8s_ns
+`
     service: |
       [SERVICE]
           Flush 1
@@ -253,22 +259,32 @@ fluent-bit:
       local reassemble_state = {}
 
       function reassemble_cri_logs(tag, timestamp, record)
-         -- IMPORTANT: reassemble_key must be unique for each parser stream
-         -- otherwise entries from different sources will get mixed up.
-         -- Either make sure that your parser tags satisfy this or construct
-         -- reassemble_key some other way
          local reassemble_key = tag
-         -- if partial line, accumulate
          if record.logtag == 'P' then
             reassemble_state[reassemble_key] = reassemble_state[reassemble_key] or "" .. record.log
             return -1, 0, 0
          end
-         -- otherwise it's a full line, concatenate with accumulated partial lines if any
          record.log = reassemble_state[reassemble_key] or "" .. (record.log or "")
          reassemble_state[reassemble_key] = nil
          return 1, timestamp, record
       end
 
+      function nest_k8s_ns(tag, timestamp, record)
+          if not record['kubernetes']['namespace_name'] then
+              return 0, 0, 0
+          end
+          new_record = {}
+          for key, val in pairs(record) do
+              if key == 'kube' then
+                  new_record[key] = {}
+                  new_record[key][record['kubernetes']['namespace_name']] = record[key]
+              else
+                  new_record[key] = record[key]
+              end
+          end
+          return 1, timestamp, new_record
+      end
+
   serviceMonitor:
     enabled: true
     namespace: monitoring