[nri-bundle] Log attribute naming mismatch causes OOTB K8s Deployment dashboards to show no log data

[chauncey-garrett]

Description

Out-of-the-box (OOTB) Kubernetes Deployment dashboards show no log data when using nri-bundle with newrelic-logging. The root cause is an attribute naming convention mismatch between the logging and metrics components of nri-bundle.

Problem

The newrelic-logging chart (Fluent Bit) emits log attributes using underscore naming, while nri-kubernetes (metrics) uses camelCase. The OOTB K8s Deployment dashboards query camelCase for both metrics and logs, so all log widgets return zero results.

Component	Convention	Example
newrelic-logging (Fluent Bit)	underscore	cluster_name, namespace_name, container_name, pod_name
nri-kubernetes (metrics)	camelCase	clusterName, namespaceName, containerName, podName
OOTB K8s Deployment dashboards	camelCase (matches metrics)	WHERE clusterName = '...' AND namespaceName = '...'

Evidence

-- Returns 0 results (camelCase — what OOTB dashboards query)
FROM Log SELECT count(*) WHERE namespaceName = 'renovate'

-- Returns 9,682 results (underscore — what Fluent Bit actually sends)
FROM Log SELECT count(*) WHERE namespace_name = 'renovate' SINCE 1 day ago

Root Cause

1. The newrelic-logging chart's record_modifier filter sets cluster_name (underscore), not clusterName.
2. There is no configuration option to change the attribute naming convention.
3. When lowDataMode is enabled, the nest filter explicitly allowlists only underscore attributes: container_name, namespace_name, pod_name, stream, message, log.
4. The OOTB K8s Deployment dashboards were built assuming camelCase for both metrics and logs.

This affects every nri-bundle deployment using OOTB K8s Deployment dashboards — not just specific configurations.

Additional Context: Three Naming Conventions

The K8s observability stack actually has three different attribute naming conventions:

Source	Convention	Example
newrelic-logging (Fluent Bit)	underscore	namespace_name
nri-kubernetes (metrics)	camelCase	namespaceName
OpenTelemetry / APM docs	dotted	k8s.namespace.name

This makes it difficult for users to write NRQL queries that work across both metrics and logs without knowing which convention each component uses.

Workaround

Add a Fluent Bit modify filter with Copy directives to create camelCase aliases:

[FILTER]
    Name           modify
    Match          *
    Copy           cluster_name clusterName
    Copy           namespace_name namespaceName
    Copy           container_name containerName
    Copy           pod_name podName

This preserves the original underscore attributes for backward compatibility while making OOTB dashboards work. The cost is 4 additional small attribute keys per log record (metadata only, no additional log lines).

Expected Behavior

OOTB K8s Deployment dashboards should show log data without requiring user-side workarounds. Either:

1. The newrelic-logging chart should emit camelCase aliases alongside underscore attributes (matching the workaround above), or
2. OOTB dashboards should query underscore attributes for logs (matching what newrelic-logging actually sends), or
3. A chart-level configuration option should allow users to choose the attribute naming convention.

Environment

• nri-bundle chart version: 5.x (also verified against current master — same behavior)
• lowDataMode: enabled globally
• Kubernetes: GKE
• Affected: All OOTB K8s Deployment dashboard log widgets across all clusters