diff --git a/charts/kubezero-logging/Chart.yaml b/charts/kubezero-logging/Chart.yaml
index 3434d60e..db122bb7 100644
--- a/charts/kubezero-logging/Chart.yaml
+++ b/charts/kubezero-logging/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-logging
 description: KubeZero Umbrella Chart for complete EFK stack
 type: application
-version: 0.3.9
+version: 0.4.0
 appVersion: 1.2.1
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
diff --git a/charts/kubezero-logging/values.yaml b/charts/kubezero-logging/values.yaml
index 957c5e03..f6823ffc 100644
--- a/charts/kubezero-logging/values.yaml
+++ b/charts/kubezero-logging/values.yaml
@@ -208,46 +208,39 @@ fluent-bit:
           Name tail
           Path /var/log/containers/*.log
           Parser cri-log
-          Tag kube.*
+          Tag cri.*
           Mem_Buf_Limit 16MB
           Skip_Long_Lines On
           Refresh_Interval 10
           DB /var/log/flb_kube.db
           DB.Sync Normal
-      [INPUT]
-          Name tail
-          Path /var/log/kubernetes/audit.log
-          Parser json
-          Tag audit.api-server
-          Mem_Buf_Limit 8MB
-          Skip_Long_Lines On
-          DB /var/log/flb_kube_audit.db
-          DB.Sync Normal
 
     filters: |
       [FILTER]
           Name    lua
-          Match   kube.*
+          Match   cri.*
           script  /fluent-bit/etc/functions.lua
           call    reassemble_cri_logs
 
       [FILTER]
           Name kubernetes
-          Match kube.*
+          Match cri.*
           Merge_Log On
+          Merge_Log_Key kube
+          Kube_Tag_Prefix cri.var.log.containers.
           Keep_Log Off
           K8S-Logging.Parser Off
           K8S-Logging.Exclude Off
 
-      #[FILTER]
-      #    Name    lua
-      #    Match   kube.*
-      #    script  /fluent-bit/etc/functions.lua
-      #    call    dedot
+      [FILTER]
+          Name rewrite_tag
+          Match cri.*
+          Emitter_Name kube_tag_rewriter
+          Rule logtag F kube.$kubernetes['namespace_name'].$kubernetes['container_name'] false
 
     service: |
       [SERVICE]
-          Flush 5
+          Flush 1
           Daemon Off
           Log_Level warn
           Parsers_File parsers.conf
@@ -257,36 +250,6 @@ fluent-bit:
           HTTP_Port 2020
 
     lua: |
-      function dedot(tag, timestamp, record)
-          if record["kubernetes"] == nil then
-              return 0, 0, 0
-          end
-          dedot_keys(record["kubernetes"]["annotations"])
-          dedot_keys(record["kubernetes"]["labels"])
-          return 1, timestamp, record
-      end
-
-      function dedot_keys(map)
-          if map == nil then
-              return
-          end
-          local new_map = {}
-          local changed_keys = {}
-          for k, v in pairs(map) do
-              local dedotted = string.gsub(k, "%.", "_")
-              if dedotted ~= k then
-                  new_map[dedotted] = v
-                  changed_keys[k] = true
-              end
-          end
-          for k in pairs(changed_keys) do
-              map[k] = nil
-          end
-          for k, v in pairs(new_map) do
-              map[k] = v
-          end
-      end
-
       local reassemble_state = {}
 
       function reassemble_cri_logs(tag, timestamp, record)