From 1c17fed77d1085288698c989ca85ea0ab8b0bf3e Mon Sep 17 00:00:00 2001 From: Mohd Husaam Mehdi Date: Mon, 4 Aug 2025 14:27:43 +0530 Subject: [PATCH] fluent-bit: align kmsg output fields with syslog fields - this allows for a better mapping to the data model - this reduces load on fluent-bit because now one OUTPUT section is sufficient (earlier we needed two output sections because of two different templates) --- fluent-bit/patches/0005-kmsg_log.patch | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/fluent-bit/patches/0005-kmsg_log.patch b/fluent-bit/patches/0005-kmsg_log.patch index ca56a7318..e517b45ed 100644 --- a/fluent-bit/patches/0005-kmsg_log.patch +++ b/fluent-bit/patches/0005-kmsg_log.patch @@ -1,5 +1,5 @@ diff --git a/plugins/in_kmsg/in_kmsg.c b/plugins/in_kmsg/in_kmsg.c -index cd5c4cd17..9524cf194 100644 +index cd5c4cd17..63d61405e 100644 --- a/plugins/in_kmsg/in_kmsg.c +++ b/plugins/in_kmsg/in_kmsg.c @@ -165,6 +165,15 @@ static inline int process_line(const char *line, @@ -18,14 +18,19 @@ index cd5c4cd17..9524cf194 100644 /* Now process the human readable message */ p = strchr(p, ';'); if (!p) { -@@ -198,7 +207,10 @@ static inline int process_line(const char *line, +@@ -197,8 +206,14 @@ static inline int process_line(const char *line, + FLB_LOG_EVENT_CSTRING_VALUE("usec"), FLB_LOG_EVENT_UINT64_VALUE(tv.tv_usec), - FLB_LOG_EVENT_CSTRING_VALUE("msg"), +- FLB_LOG_EVENT_CSTRING_VALUE("msg"), - FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1)); ++ FLB_LOG_EVENT_CSTRING_VALUE("ident"), ++ FLB_LOG_EVENT_STRING_VALUE("kernel", 6), ++ ++ FLB_LOG_EVENT_CSTRING_VALUE("message"), + FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1), + -+ FLB_LOG_EVENT_CSTRING_VALUE("syslog_ts"), ++ FLB_LOG_EVENT_CSTRING_VALUE("time"), + FLB_LOG_EVENT_STRING_VALUE(syslog_ts, syslog_ts_len)); }