Hey guys, I'm new to Fluent-bit, and I'm trying to...
# fluent-bit
g
Hey guys, I'm new to Fluent-bit, and I'm trying to adjust my logs to our required format. However sadly not a single change i make to my helm values.yaml file is reflected onto my logs. Is there anyone who could help me out? 🙂 Looking forward to it. For those interested, I would like to lift my body of be individual key value pairs. And I'm reading directly from my .log files
Copy code
{
  "body": "2025-10-27T13:54:18.47655819Z stderr F {\"timestamp\":\"2025-10-27T13:54:18.475990Z\",\"level\":\"INFO\",\"fields\":{\"message\":\"handling request\",\"workflow_id\":\"0d7ec256-ee9c-4c85-87cf-7e248c1eaccd\",\"function_name\":\"handle_tracing_logs\",\"method\":\"GET\"}}",
  "id": "0iOAZU9FM7mFS1yxuQ1fYdiI1sN",
  "timestamp": 1761573258477877800,
  "attributes": {
    "fluent.tag": "kube.var.log.containers.tracing-logs-7c5c8dbf5b-7q6hr_default_tracing-logs-5b0b870e3ac845ec4198de2c28bad0c270b3e9e14798d490691ae0b2c0e3f005.log"
  },
  "resources": {},
  "scope": {},
  "severity_text": "",
  "severity_number": 0,
  "scope_name": "",
  "scope_version": "",
  "span_id": "",
  "trace_flags": 0,
  "trace_id": ""
}
This is an example from this service its logfile
Copy code
{
  "timestamp": "2025-10-27T14:09:49.486890Z",
  "level": "INFO",
  "fields": {
    "message": "request completed",
    "workflow_id": "f76293c4-d371-4d15-bb56-48c1d987a944",
    "function_name": "handle_tracing_logs",
    "execution_time_ms": "0",
    "execution_time_ns": "178129",
    "execution_time_us": "178"
  }
}
p
What do you mean they're not reflected, as in the config does not change - did you check the config map?
Or do you just mean it's not working and what is not working? What's your actual config?
Normally I would recommend to iterate locally with a simple container approach then once working move it into helm: use stdout as well to check the outputs.
It looks to me like you're just getting the default of the entire log line in your body message presumably with some kind of OTEL output?
Typically you would use the
multiline.parser cri, docker
configuration in tail recommended by the docs: https://www.fluent.do/blog/kubernetes-logging#mounting-container-logs This should at least split out the timestamp, stream and P/F fields.