k8s log source questions

[atibdialpad]

@jszwedko I had couple of questions around the usage of vector's k8s source :

1. Do I need to mount my container logs to a shared volume (/var/logs/pod_logs) on the kube-node to enable Vector to consume container logs ?
2. Datadog Agent daemon set allows to add additional tags to log events via setting environment variable in the daemon set declaration, examples a) common tags from env here, b) append pod labels as tags to log events here .Is something like that possible to do in Vector ?

[atibdialpad]

[Update]
Got the answer for the first question.
It seems Vector is using node-level logging technique which requires all pod/container logs to be in a directory. (/var/log/pods or /var/log/containers which is just a symlink to the pod dir) on the node and I see kubelet already creates these directories.

[atibdialpad]

[Update 2] On the second question :
Vector already adds pod_labels to the log events like what ddagent does pod labels as tags
It would be great if we could add custom tags as well like DD_TAGS and node labels as tags

[jszwedko]

Thanks for updating!

I agree that we should allow node labels as tags; I opened #7499

For DD_TAGS you can do this now via remap with something like:

[transforms.remap]
type = "remap"
inputs = [ ... ]
source = """
.some_tag = .some_value
"""

Would that meet your needs? One notable difference from the Datadog agent is that we only support key/value pairs for tags.