Promtail template stage not working in k8s

The template stage cannot reference the values in the map (the values are all empty)

  • k8s uses docker CRI

Here is my log sample:

2022-11-10 18:14:51,982 [,] INFO  [AsyncResolver-bootstrap-executor-0] com.netflix.discovery.shared.resolver.aws.ConfigClusterResolver: Resolving eureka endpoints via configuration

regex:

(?P<time>\d+-\d+-\d+\s\S+)\s\[(?P<trace>\w*),(?P<span>\w*)]\s(?P<level>\w+)\s+\[(?P<thread>[^]]+)]\s(?P<class>[^:]+):\s(?P<message>.*)

regex works fine and can extract fields into map

Promtail configuration file:

- job_name: my-job
  pipeline_stages:
    - docker: {}
    - multiline:
        firstline: '^\d+-\d+-\d+\s\d+:\d+:\d+,\d+\s'
        max_wait_time: 5s
        max_lines: 128
    - regex:
        expression: '(?P<time>\d+-\d+-\d+\s\S+)\s\[(?P<trace>\w*),(?P<span>\w*)]\s(?P<level>\w+)\s+\[(?P<thread>[^]]+)]\s(?P<class>[^:]+):\s(?P<message>.*)'
    - labels:
        level:
    - template:
        source: out_message
        template: '{"time": "{{ .time }}", "trace": "{{ .trace }}", "span": "{{ .span }}", "level": "{{ .level }}", "thread": "{{ .thread }}", "class": "{{ .class }}", "message": "{{ .message }}"}'
    - output:
        source: out_message

The output is not as expected, all json keys have empty values!

promtail image:

image: grafana/promtail:2.5.0
imageID: docker-pullable://grafana/promtail@sha256:8cce5a28c6515ec88603caf07236855873b2a574f23891ddffb269d60a74ed42

My configuration looks correct, but I don’t know why it doesn’t work, and I didn’t find an answer on the internet, please help ! Thanks all

this problem has been solved !
Go templates need to be escape when deploying with helm。

- template:
  source: msg
  template: '{"time": "{{`{{ .time }}`}}", "trace": "{{`{{ .trace }}`}}", "span": "{{`{{ .span }}`}}", "level": "{{`{{ .level }}`}}", "thread": "{{`{{ .thread }}`}}", "class": "{{`{{ .class }}`}}", "message": "{{`{{ .message }}`}}"}'

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.