Drop logs

Label based

Logs can be dropped in Promtail according to their labels.

A non-exhaustive list of log labels :

• namespace
• container_name
• namespace
• instance (pod name)

We can select the logs to drop if the label :

• is equal to a value
• is not equal to a value
• regex matches
• regex does not match

Examples :

• drop logs of all pods in caascad-monitoring namespace:

  pipelineStages:
  - match:
      selector: '{namespace="caascad-monitoring"}'
      action: drop
  

• drop logs of all pods in namespaces starting with caascad-:

  pipelineStages:
  - match:
      selector: '{namespace=~"caascad-.*"}'
      action: drop
  

• drop logs of pods that are not in namespaces caascad-logging, caascad-monitoring, and kube-system:

  pipelineStages:
  - match:
      selector: '{namespace!~"(caascad-monitoring|caascad-logging|kube-system)"}'
      action: drop
  

• drop logs with container name equal to kube-state-metrics:

  pipelineStages:
  - match:
      selector: '{container_name="kube-state-metrics"}'
      action: drop
  

Content based

We can select the logs to drop if log line :

• contains string
• does not contain string
• matches regular expression
• does not match regular expression

Examples :

• drop logs if Unauthorized in content:

  pipelineStages:
  - match:
      selector: '{namespace=~".*"} |= "Unauthorized"'
      action: drop
  

• drop logs if Unauthorized not in content:

  pipelineStages:
  - match:
      selector: '{namespace=~".*"} != "Unauthorized"'
      action: drop
  

• drop logs if .*client.* match with content:

  pipelineStages:
  - match:
      selector: '{namespace=~".*"} |~ ".*client.*"'
      action: drop
  

• drop logs if .*client.* not match with content:

  pipelineStages:
  - match:
      selector: '{namespace=~".*"} !~ ".*client.*"'
      action: drop