Containerlogv2 Metadata and annotations based filtering (#1148)

* add fluent-bit kubernetes filter (#1115) * add fluent-bit kubernetes filter --------- Co-authored-by: Amol Agrawal <[email protected]> * add metadata feilds including labels, annotations, uid and image (#1120) * add metadata feilds including labels, annotations, uid and image * set the include_fields if customer set it otherwise go with default if enabled * fix minor bugs * change placeholder * add exclude specific kubernetes config * update tls verify for linux * make log filtering opt in explicit (#1140) Co-authored-by: Amol Agrawal <[email protected]> * Longw/metadata containerlogv2 kubernetes (#1139) * add metadata feilds including labels, annotations, uid and image * rename to podUid and add nil check * set the include_fields if customer set it otherwise go with default if enabled * add workload to testing clusters * containerlogv2 metadata backend change with feature flag on * adjust the marshal and log the output * address comments add check and scenario for empty list * remove ADX support * go fmt for better format * fix space in tomlparser.rb * update trivy ignore * fix Kube_Tag_Prefix for windows * update trivy * add ttl for metadata cache * update containerlogv2 test workloads * change typo and update tests * Longw/metadata containerlogv2 address feedback (#1166) * add argument for sendMetric * update SendMetric * update SendMetric * Longw/metadata containerlogv2 address feedback2 (#1186) * extend to support more configs on metadata * add warning message if feilds not match * add plugin for geneva path * add kubernetesMetadataCollection for geneva path * Longw/metadata containerlogv2 address feedback2 (#1188) * remove send metric * update trivy * Longw/metadata containerlogv2 address feedback3 (#1195) * update doc for containerlogv2 linux * add kube_meta_cache_ttl to agent settings * update logic to adjust colonLocation as the end of the list if it is not found * address comments and feedback * update conf file for geneva * adjust geneva and add new metrics * address feedback for geneva path * add telemetry in go * address comments for geneva conf filter config --------- Co-authored-by: Amol Agrawal <[email protected]> Co-authored-by: Amol Agrawal <[email protected]>
microsoft · Mar 19, 2024 · 33b1b6a · 33b1b6a
1 parent 83946e7
commit 33b1b6a
Show file tree

Hide file tree

Showing 24 changed files with 552 additions and 32 deletions.
diff --git a/.trivyignore b/.trivyignore
@@ -11,7 +11,6 @@ CVE-2024-28110
 CVE-2024-27289
 CVE-2024-27304
 GHSA-7jwh-3vrq-q3m8
-CVE-2024-27304
 CVE-2024-24786
 
 #telegraf HIGH
@@ -29,3 +28,4 @@ CVE-2023-5678
 
 #golang MEDIUM
 CVE-2023-48795
+CVE-2024-24786
diff --git a/Documentation/Internal/ContainerLogV2-Linux.xml b/Documentation/Internal/ContainerLogV2-Linux.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<MonitoringManagement version="1.0" namespace="<NamespaceForLinuxContainers>" eventVersion="1" timestamp="2016-01-20T00:00:00.000">
+<MonitoringManagement version="1.1" namespace="<NamespaceForLinuxContainers>" eventVersion="1" timestamp="2016-01-20T00:00:00.000">
   <Accounts>
     <Account moniker="<GenevaLogsAccountMoniker>" isDefault="true" />
   </Accounts>
@@ -25,6 +25,7 @@
       <Column name="Computer" type="str" mdstype="mt:wstr" />
       <Column name="ContainerName" type="str" mdstype="mt:wstr" />
       <Column name="AzureResourceId" type="str" mdstype="mt:wstr" />
+      <Column name="KubernetesMetadata" type="str" mdstype="mt:wstr" />
     </Schema>
   </Schemas>
   <Sources>

diff --git a/build/common/installer/scripts/fluent-bit-conf-customizer.rb b/build/common/installer/scripts/fluent-bit-conf-customizer.rb
@@ -77,6 +77,8 @@ def substituteFluentBitPlaceHolders
     stacktraceLanguages = ENV["AZMON_MULTILINE_LANGUAGES"]
     resourceOptimizationEnabled = ENV["AZMON_RESOURCE_OPTIMIZATION_ENABLED"]
     windowsFluentBitDisabled = ENV["AZMON_WINDOWS_FLUENT_BIT_DISABLED"]
+    kubernetesMetadataCollection = ENV["AZMON_KUBERNETES_METADATA_ENABLED"]
+    annotationBasedLogFiltering = ENV["AZMON_ANNOTATION_BASED_LOG_FILTERING"]
 
     serviceInterval = (!interval.nil? && is_number?(interval) && interval.to_i > 0) ? interval : @default_service_interval
     serviceIntervalSetting = "Flush         " + serviceInterval
@@ -113,6 +115,16 @@ def substituteFluentBitPlaceHolders
       new_contents = new_contents.gsub("\n    ${TAIL_IGNORE_OLDER}\n", "\n")
     end
 
+    if !kubernetesMetadataCollection.nil? && kubernetesMetadataCollection.to_s.downcase == "true"
+      new_contents = new_contents.gsub("#${KubernetesFilterEnabled}", "")
+    end
+
+    if !annotationBasedLogFiltering.nil? && annotationBasedLogFiltering.to_s.downcase == "true"
+      # enabled kubernetes filter plugin if not already enabled
+      new_contents = new_contents.gsub("#${KubernetesFilterEnabled}", "")
+      new_contents = new_contents.gsub("#${AnnotationBasedLogFilteringEnabled}", "")
+    end
+
     new_contents = substituteMultiline(multilineLogging, stacktraceLanguages, new_contents)
 
     if !@isWindows || (@isWindows && (!windowsFluentBitDisabled.nil? && windowsFluentBitDisabled.to_s.downcase == "false"))

diff --git a/build/common/installer/scripts/fluent-bit-geneva-conf-customizer.rb b/build/common/installer/scripts/fluent-bit-geneva-conf-customizer.rb
@@ -4,15 +4,19 @@
 LINUX_CONFIG_PATHS = {
   "common" => "/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva.conf",
   "infra" => "/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_infra.conf",
+  "infra_filter" => "/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_infra_filter.conf",
   "tenant" => "/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_tenant.conf",
+  "tenant_filter" => "/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_tenant_filter.conf",
 }
 
 WINDOWS_CONFIG_PATHS = {
   "common" => "/etc/fluent-bit/fluent-bit-geneva.conf",
   "infra" => "/etc/fluent-bit/fluent-bit-geneva-logs_infra.conf",
+  "infra_filter" => "/etc/fluent-bit/fluent-bit-geneva-logs_infra_filter.conf",
   "tenant" => "/etc/fluent-bit/fluent-bit-geneva-logs_tenant.conf",
+  "tenant_filter" => "/etc/fluent-bit/fluent-bit-geneva-logs_tenant_filter.conf",
 }
-SUPPORTED_CONFIG_TYPES = ["common", "infra", "tenant"]
+SUPPORTED_CONFIG_TYPES = ["common", "infra", "tenant", "infra_filter", "tenant_filter"]
 
 @default_service_interval = "15"
 @default_mem_buf_limit = "10"
@@ -40,6 +44,8 @@ def substituteFluentBitPlaceHolders(configFilePath)
     multilineLogging = ENV["AZMON_MULTILINE_ENABLED"]
     stacktraceLanguages = ENV["AZMON_MULTILINE_LANGUAGES"]
     enableFluentBitThreading = ENV["ENABLE_FBIT_THREADING"]
+    kubernetesMetadataCollection = ENV["AZMON_KUBERNETES_METADATA_ENABLED"]
+    annotationBasedLogFiltering = ENV["AZMON_ANNOTATION_BASED_LOG_FILTERING"]
 
     serviceInterval = is_valid_number?(interval) ? interval : @default_service_interval
     serviceIntervalSetting = "Flush         " + serviceInterval
@@ -82,6 +88,16 @@ def substituteFluentBitPlaceHolders(configFilePath)
       new_contents = new_contents.gsub("\n    ${TAIL_THREADED}\n", "\n")
     end
 
+    if !kubernetesMetadataCollection.nil? && kubernetesMetadataCollection.to_s.downcase == "true"
+      new_contents = new_contents.gsub("#${KubernetesFilterEnabled}", "")
+    end
+
+    if !annotationBasedLogFiltering.nil? && annotationBasedLogFiltering.to_s.downcase == "true"
+      # enabled kubernetes filter plugin if not already enabled
+      new_contents = new_contents.gsub("#${KubernetesFilterEnabled}", "")
+      new_contents = new_contents.gsub("#${AnnotationBasedLogFilteringEnabled}", "")
+    end
+
     if !multilineLogging.nil? && multilineLogging.to_s.downcase == "true"
       if !stacktraceLanguages.nil? && !stacktraceLanguages.empty?
         new_contents = new_contents.gsub("#${MultilineEnabled}", "")

diff --git a/build/common/installer/scripts/tomlparser-common-agent-config.rb b/build/common/installer/scripts/tomlparser-common-agent-config.rb
@@ -9,6 +9,7 @@
 @configSchemaVersion = ""
 
 @disableTelemetry = false
+@logEnableKubernetesMetadataCacheTTLSeconds = 60
 
 def is_windows?
   return !@os_type.nil? && !@os_type.empty? && @os_type.strip.casecmp("windows") == 0
@@ -57,6 +58,20 @@ def populateSettingValuesFromConfigMap(parsedConfig)
         puts "Using config map value: disable_telemetry = #{@disableTelemetry}"
       end
     end
+
+    # agent config for kube_meta_cache_ttl_secs which used in containerlogv2 kubernetes metadata and annotation based filtering
+    if !parsedConfig.nil? && !parsedConfig[:agent_settings].nil?
+      k8s_metadata_config = parsedConfig[:agent_settings][:k8s_metadata_config]
+      if !k8s_metadata_config.nil? && !k8s_metadata_config[:kube_meta_cache_ttl_secs].nil?
+        ttl_value = k8s_metadata_config[:kube_meta_cache_ttl_secs]
+        if ttl_value.is_a?(Integer) && ttl_value >= 0
+          @logEnableKubernetesMetadataCacheTTLSeconds = ttl_value
+          puts "config::INFO: Using config map value: kube_meta_cache_ttl_secs = #{@logEnableKubernetesMetadataCacheTTLSeconds}"
+        else
+          puts "config::WARN: Using the default value for kube_meta_cache_ttl_secs since provided config value is invalid"
+        end
+      end
+    end
   rescue => errorStr
     puts "config::error:Exception while reading config settings for agent configuration setting - #{errorStr}, using defaults"
   end
@@ -87,6 +102,8 @@ def get_command_windows(env_variable_name, env_variable_value)
       commands = get_command_windows("DISABLE_TELEMETRY", @disableTelemetry)
       file.write(commands)
     end
+    commands = get_command_windows("AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS", @logEnableKubernetesMetadataCacheTTLSeconds)
+    file.write(commands)
     # Close file after writing all environment variables
     file.close
     puts "****************End Config Processing********************"
@@ -101,7 +118,7 @@ def get_command_windows(env_variable_name, env_variable_value)
     if @disableTelemetry
       file.write("export DISABLE_TELEMETRY=#{@disableTelemetry}\n")
     end
-
+    file.write("export AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS=#{@logEnableKubernetesMetadataCacheTTLSeconds}\n")
     # Close file after writing all environment variables
     file.close
   else

diff --git a/build/common/installer/scripts/tomlparser.rb b/build/common/installer/scripts/tomlparser.rb
@@ -25,6 +25,9 @@
 @adxDatabaseName = "containerinsights" # default for all configurations
 @logEnableMultiline = "false"
 @stacktraceLanguages = "go,java,python" #supported languages for multiline logs. java is also used for dotnet stacktraces
+@logEnableKubernetesMetadata = false
+@logKubernetesMetadataIncludeFields = "podlabels,podannotations,poduid,image,imageid,imagerepo,imagetag"
+@annotationBasedLogFiltering = false
 if !@os_type.nil? && !@os_type.empty? && @os_type.strip.casecmp("windows") == 0
   @containerLogsRoute = "v1" # default is v1 for windows until windows agent integrates windows ama
   # This path format is necessary for fluent-bit in windows
@@ -228,6 +231,44 @@ def populateSettingValuesFromConfigMap(parsedConfig)
     rescue => errorStr
       ConfigParseErrorLogger.logError("Exception while reading config map settings for adx database name - #{errorStr}, using default #{@adxDatabaseName}, please check config map for errors")
     end
+
+    #Get Kubernetes Metadata setting
+    begin
+      if !parsedConfig[:log_collection_settings][:metadata_collection].nil? && !parsedConfig[:log_collection_settings][:metadata_collection][:enabled].nil?
+        puts "config::INFO: Using config map setting for kubernetes metadata"
+        @logEnableKubernetesMetadata = parsedConfig[:log_collection_settings][:metadata_collection][:enabled]
+        if !parsedConfig[:log_collection_settings][:metadata_collection][:include_fields].nil?
+          puts "config::INFO: Using config map setting for kubernetes metadata include fields"
+          include_fields = parsedConfig[:log_collection_settings][:metadata_collection][:include_fields]
+          if include_fields.empty?
+            puts "config::WARN: Include fields specified for Kubernetes metadata is empty, disabling Kubernetes metadata"
+            @logEnableKubernetesMetadata = false
+          elsif include_fields.kind_of?(Array)
+            include_fields.map!(&:downcase)
+            predefined_fields = @logKubernetesMetadataIncludeFields.downcase.split(',')
+            any_field_match = include_fields.any? { |field| predefined_fields.include?(field) }
+            if any_field_match
+              @logKubernetesMetadataIncludeFields = include_fields.join(",")
+            else
+              puts "config:: WARN: Include fields specified for Kubernetes metadata does not match any predefined fields, disabling Kubernetes metadata"
+              @logEnableKubernetesMetadata = false
+            end
+          end
+        end
+      end
+    rescue => errorStr
+      ConfigParseErrorLogger.logError("config::error: Exception while reading config map settings for kubernetes metadata - #{errorStr}, please check config map for errors")
+    end
+
+    #Get annotation based log filtering setting
+    begin
+      if !parsedConfig[:log_collection_settings][:filter_using_annotations].nil? && !parsedConfig[:log_collection_settings][:filter_using_annotations][:enabled].nil?
+        puts "config::INFO: Using config map setting for annotation based log filtering"
+        @annotationBasedLogFiltering = parsedConfig[:log_collection_settings][:filter_using_annotations][:enabled]
+      end
+    rescue => errorStr
+      ConfigParseErrorLogger.logError("config::error: Exception while reading config map settings for annotation based log filtering - #{errorStr}, please check config map for errors")
+    end
   end
 end
 
@@ -276,6 +317,9 @@ def populateSettingValuesFromConfigMap(parsedConfig)
   file.write("export AZMON_ADX_DATABASE_NAME=#{@adxDatabaseName}\n")
   file.write("export AZMON_MULTILINE_ENABLED=#{@logEnableMultiline}\n")
   file.write("export AZMON_MULTILINE_LANGUAGES=#{@stacktraceLanguages}\n")
+  file.write("export AZMON_KUBERNETES_METADATA_ENABLED=#{@logEnableKubernetesMetadata}\n")
+  file.write("export AZMON_KUBERNETES_METADATA_INCLUDES_FIELDS=#{@logKubernetesMetadataIncludeFields}\n")
+  file.write("export AZMON_ANNOTATION_BASED_LOG_FILTERING=#{@annotationBasedLogFiltering}\n")
   # Close file after writing all environment variables
   file.close
   puts "Both stdout & stderr log collection are turned off for namespaces: '#{@excludePath}' "
@@ -342,6 +386,12 @@ def get_command_windows(env_variable_name, env_variable_value)
     file.write(commands)
     commands = get_command_windows("AZMON_MULTILINE_LANGUAGES", @stacktraceLanguages)
     file.write(commands)
+    commands = get_command_windows("AZMON_KUBERNETES_METADATA_ENABLED", @logEnableKubernetesMetadata)
+    file.write(commands)
+    commands = get_command_windows("AZMON_KUBERNETES_METADATA_INCLUDES_FIELDS", @logKubernetesMetadataIncludeFields)
+    file.write(commands)
+    commands = get_command_windows("AZMON_ANNOTATION_BASED_LOG_FILTERING", @annotationBasedLogFiltering)
+    file.write(commands)
     # Close file after writing all environment variables
     file.close
     puts "Both stdout & stderr log collection are turned off for namespaces: '#{@excludePath}' "

diff --git a/build/linux/installer/conf/fluent-bit-geneva-logs_infra_filter.conf b/build/linux/installer/conf/fluent-bit-geneva-logs_infra_filter.conf
@@ -0,0 +1,13 @@
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               geneva_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               geneva.container.log.infra.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     geneva.container.log.infra.var.log.containers.
diff --git a/build/linux/installer/conf/fluent-bit-geneva-logs_tenant_filter.conf b/build/linux/installer/conf/fluent-bit-geneva-logs_tenant_filter.conf
@@ -0,0 +1,13 @@
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               geneva_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               geneva.container.log.tenant.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     geneva.container.log.tenant.var.log.containers.
diff --git a/build/linux/installer/conf/fluent-bit.conf b/build/linux/installer/conf/fluent-bit.conf
@@ -47,5 +47,19 @@
     Match oms.container.log.la.*
     Exclude stream ${AZMON_LOG_EXCLUSION_REGEX_PATTERN}
 
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               oms_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               oms.container.log.la.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     oms.container.log.la.var.log.containers.
+
 @INCLUDE fluent-bit-common.conf
 @INCLUDE fluent-bit-internal-metrics.conf
diff --git a/build/linux/installer/datafiles/base_container.data b/build/linux/installer/datafiles/base_container.data
@@ -50,7 +50,9 @@ MAINTAINER:              'Microsoft Corporation'
 /etc/opt/microsoft/docker-cimprov/fluent-bit-common.conf;			    build/linux/installer/conf/fluent-bit-common.conf;                644; root; root
 /etc/opt/microsoft/docker-cimprov/fluent-bit-geneva.conf;			    build/linux/installer/conf/fluent-bit-geneva.conf;                644; root; root
 /etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_infra.conf;  build/linux/installer/conf/fluent-bit-geneva-logs_infra.conf;   644; root; root
+/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_infra_filter.conf;  build/linux/installer/conf/fluent-bit-geneva-logs_infra_filter.conf;   644; root; root
 /etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_tenant.conf; build/linux/installer/conf/fluent-bit-geneva-logs_tenant.conf;   644; root; root
+/etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-logs_tenant_filter.conf; build/linux/installer/conf/fluent-bit-geneva-logs_tenant_filter.conf;   644; root; root
 /etc/opt/microsoft/docker-cimprov/fluent-bit-geneva-telemetry-svc.conf;          build/linux/installer/conf/fluent-bit-geneva-telemetry-svc.conf;   644; root; root
 /etc/opt/microsoft/docker-cimprov/fluent-bit-internal-metrics.conf;    build/linux/installer/conf/fluent-bit-internal-metrics.conf; 644; root; root
 

diff --git a/build/windows/installer/conf/fluent-bit-geneva-logs_infra_filter.conf b/build/windows/installer/conf/fluent-bit-geneva-logs_infra_filter.conf
@@ -0,0 +1,13 @@
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               geneva_win_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               geneva.container.log.infra.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     geneva.container.log.infra.C.var.log.containers.
diff --git a/build/windows/installer/conf/fluent-bit-geneva-logs_tenant_filter.conf b/build/windows/installer/conf/fluent-bit-geneva-logs_tenant_filter.conf
@@ -0,0 +1,13 @@
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               geneva_win_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               geneva.container.log.tenant.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     geneva.container.log.tenant.C.var.log.containers.
diff --git a/build/windows/installer/conf/fluent-bit.conf b/build/windows/installer/conf/fluent-bit.conf
@@ -45,5 +45,19 @@
     Match oms.container.log.la.*
     Exclude stream ${AZMON_LOG_EXCLUSION_REGEX_PATTERN}
 
+#${KubernetesFilterEnabled}[FILTER]
+#${KubernetesFilterEnabled}    Name                kubernetes
+#${KubernetesFilterEnabled}    Alias               oms_win_kubernetes_filter
+#${KubernetesFilterEnabled}    Match               oms.container.log.la.*
+#${KubernetesFilterEnabled}    Merge_Log           Off
+#${KubernetesFilterEnabled}    Buffer_Size         0
+#${KubernetesFilterEnabled}    Use_Kubelet         true
+#${KubernetesFilterEnabled}    Kubelet_Port        10250
+#${KubernetesFilterEnabled}    Kubelet_Host        ${NODE_IP}
+#${KubernetesFilterEnabled}    tls.verify          Off
+#${KubernetesFilterEnabled}#${AnnotationBasedLogFilteringEnabled}    K8S-Logging.Exclude On
+#${KubernetesFilterEnabled}    Kube_Meta_Cache_TTL ${AZMON_KUBERNETES_METADATA_CACHE_TTL_SECONDS}
+#${KubernetesFilterEnabled}    Kube_Tag_Prefix     oms.container.log.la.C.var.log.containers.
+
 @INCLUDE fluent-bit-common.conf
 @INCLUDE fluent-bit-internal-metrics.conf
diff --git a/charts/azuremonitor-containers-geneva/templates/deployment.yaml b/charts/azuremonitor-containers-geneva/templates/deployment.yaml
@@ -39,6 +39,10 @@ spec:
                 fieldPath: metadata.namespace
          - name: ENABLE_FBIT_INTERNAL_METRICS
            value: {{ .Values.enableInternalMetrics | quote }}
+         - name: AZMON_KUBERNETES_METADATA_ENABLED
+           value: {{ .Values.enableKubernetesMetadata | quote }}
+         - name: AZMON_KUBERNETES_METADATA_INCLUDES_FIELDS
+           value: {{ .Values.kubernetesMetadataIncludeFields | quote }}
          - name: FBIT_SERVICE_GRACE_INTERVAL_SECONDS
            value: "10"
          - name: GENEVA_LOGS_INTEGRATION_SERVICE_MODE

diff --git a/charts/azuremonitor-containers-geneva/values.yaml b/charts/azuremonitor-containers-geneva/values.yaml
@@ -20,6 +20,8 @@ image:
   agentVersion: "azure-mdsd-1.29.7"
 nameOverride: ""
 enableInternalMetrics: false
+enableKubernetesMetadata: false
+kubernetesMetadataIncludeFields: "podlabels,podannotations,poduid,image,imageid,imagerepo,imagetag"
 fullnameOverride: ""
 podAnnotations: {}
 service: