From 845306aa8648b87e2849b78199b042c9b433652e Mon Sep 17 00:00:00 2001
From: Saikrishna <saikrishna.edupuganti@intel.com>
Date: Wed, 5 Dec 2018 23:39:44 +0000
Subject: [PATCH] Scrape crio logs, includes kata logs too

We see kata logs with `SYSLOG_IDENTIFIER:kata-runtime` under
`_SYSTEMD_UNIT:crio.service` in kibana. Need to verify if this holds
good for `SYSLOG_IDENTIFIER=kata-proxy` and `SYSLOG_IDENTIFIER=kata-shim`

Signed-off-by: Saikrishna Edupuganti <saikrishna.edupuganti@intel.com>
---
 .../3-efk/fluentd-es-configmap.yaml           | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml b/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml
index e383499..c1fecf8 100644
--- a/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml
+++ b/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml
@@ -320,7 +320,7 @@ data:
     <source>
       @id journald-container-runtime
       @type systemd
-      matches [{ "_SYSTEMD_UNIT": "{{ container_runtime }}.service" }]
+      matches [{ "_SYSTEMD_UNIT": "crio.service" }]
       <storage>
         @type local
         persistent true
@@ -330,16 +330,16 @@ data:
       tag container-runtime
     </source>
 
-    <source>
-      @type systemd
-      path /var/log/journal
-      matches [{"SYSLOG_IDENTIFIER": "kata-runtime"}, {"SYSLOG_IDENTIFIER": "kata-proxy"}, {"SYSLOG_IDENTIFIER": "kata-shim"}]
-      tag kata-containers
-      <entry>
-        fields_strip_underscores true
-        fields_lowercase true
-      </entry>
-    </source>
+    # <source>
+    #   @type systemd
+    #   path /var/log/journal
+    #   matches [{"SYSLOG_IDENTIFIER": "kata-runtime"}, {"SYSLOG_IDENTIFIER": "kata-proxy"}, {"SYSLOG_IDENTIFIER": "kata-shim"}]
+    #   tag kata-containers
+    #   <entry>
+    #     fields_strip_underscores true
+    #     fields_lowercase true
+    #   </entry>
+    # </source>
 
     <source>
       @id journald-kubelet