fluent.conf

<source>
  @type systemd
  <storage>
    @type local
    persistent true
    path /var/log/fluent/journal.pos
  </storage>
  path /run/log/journal
  tag journal
  read_from_head true
  filters [{ "_SYSTEMD_UNIT": "docker.service" }]
  <entry>
  field_map {"_HOSTNAME": "Node"}
  fields_strip_underscores true
  </entry>
</source>

# probably want to use something like fluent-plugin-rewrite-tag-filter to
# retag entries from k8s
<match journal>
  @type rewrite_tag_filter
  <rule>
    key CONTAINER_NAME
    pattern ^k8s_
    tag kubernetes.journal.container
  </rule>
</match>

<filter kubernetes.**>
  @type kubernetes_metadata
  use_journal true
</filter>

# 2018-01-30 add for filter namespace
<filter kubernetes.**>
  @type record_transformer
  enable_ruby true
  <record>
    kubernetes_namespace_container_name ${record["kubernetes"]["namespace_name"]}.${record["kubernetes"]["container_name"]}
  </record>
</filter>

<match kubernetes.**>
  @type rewrite_tag_filter
  # Update the tag have a structure of kube.<namespace>.<containername>
  <rule>
    key kubernetes_namespace_container_name
    pattern ^(.+)$
    tag kube.$1
  </rule>
</match>

<match kube.kube-system.**>
  @type null
</match>

# Easy to debug
#<match **>
#  @type stdout
#</match>

# Remove unnecessary fields
<match **>
  @type elasticsearch
  host FLUENT_ELASTICSEARCH_HOST
  port FLUENT_ELASTICSEARCH_PORT
  user FLUENT_ELASTICSEARCH_USER
  password FLUENT_ELASTICSEARCH_PASSWORD
  index_name kubernetes-%Y%m%d
  type_name docker-fluentd
  remove_keys EXE,CMDLINE,SYSTEMD_CGROUP,SYSTEMD_SLICE,UID,GID,PRIORITY,CAP_EFFECTIVE,BOOT_ID
  logstash_format true
  logstash_prefix kubernetes
</match>