►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Fluent Bit - Eduardo Silva & Masahiro Nakagawa, Treasure Data
On this deep dive session for Fluentd and Fluent Bit projects, we will dig into the internals of a logging pipeline, performance optimizations and work together in the roadmap for 2019 based on community needs for their production environments. All Fluentd and Fluent Bit users are welcome.
To learn more click here: https://sched.co/FuLW
A
A
Okay-
and
before
that
are
talking
about
this,
we
need
to
explain
a
little
bit
about
login
learning
in
general
is
not
fun,
it's
not
fancy,
but
you
have
it
because
you
want
to
accomplish
this,
which
is
called
data
analysis,
and
when
you
want
to
accomplish
login,
you
usually
has
many
a
kind
of
source
of
information.
Okay
and
this
source
of
information
I
mean
can
be
locked
files,
messages,
arriving
from
TCP,
UDP
or
or
any
kind
of
different
channel,
and
also
the
data
that
comes
and
flows
through
these
channels
comes
in
different
formats.
A
So,
as
you
can
realize,
log
in
by
itself
is
quite
complex
because
it's
not
like
every
environment
has
a
like
a
JSON
format,
logins
and
ERISA,
or
one
binary
format.
In
reality,
you
have
different
formats,
different
ways
to
collect
data
and
we
need
to
have
a
way
to
deal
with
that.
Okay,
so
how
to
deal
with
this?
A
A
years
ago
when
fluent
II
was
decided,
they
come
up
with
this
design,
which
is
called
the
login
pipeline,
meaning
that
if
you
are
going
to
deal
with
login,
you
need
to
go
to
different
phases
to
accomplish
this
of
processed
data
from
multiple
sources,
multiple
formats
and
send
that
data
out.
So
basically,
we
said
that
we
have
an
input
means
from
where
we
collect
the
data
right,
TCP,
UDP
or
system.
Then
we
have
a
parser
and
the
person
section
or
step
means
a
whole
I'm
going
to
interpret
this
data
right.
A
A
Then
we
have
the
filter,
which
basically
said
the
filter
is
like
okay.
Sometimes
you
would
like
to
have
all
your
data
that
is
flowing
through
the
inputs,
but
maybe
you
would
like
to
drop
some
data
and
say
all
these
data.
That's
coming
from
this
a
specific
TCP
port.
Maybe
I,
don't
want
all
of
them,
maybe
when
the
fraction
or
maybe
just
want
to
discard
it
or
maybe
I-
want
to
append
more
information
to
this
same
log,
for
example
in
kubernetes
the
fill
that
is
really
important.
If
you're
running
kubernetes
you
have
the
container.
A
The
container
is
appending
a
the
message
right.
You
have
the
message.
You
have
the
container
name
container,
I'm,
sorry
continent
name,
continuity,
pot
name,
but
also
you
would
like
to
get
labels
and
annotations,
and
that
information
comes
from
the
API
server
and
you
need
to
have
a
filter
to
accomplish
that.
We're
going
to
explain
that
a
little
bit
and
then
you
would
like
to
have
some
kind
of
buffering,
because
if
you
collect
some
data
here,
what
you
don't
want
in
login
is
lost
data.
A
You
don't
want
to
lost
data,
so
buffering
allows
you
to
take
this
information
that
you
Joe
got
goats
from
somewhere.
You
parse
your
filter
and
state
safe
in
one
place
can
be
either
made
in
memory
or
the
file
system
because
you're
going
to
flush
this
data
to
a
cloud
service
or
a
database.
But
as
you
know,
the
things
can
go
wrong.
Okay
in
networking,
the
things
fails
well
like
in
everything
related
with
computers.
A
So
if
something
happens
here-
and
it
cannot
flush
the
data
because
maybe
my
output
is
elasticsearch
and
it's
down-
I
need
to
have
a
copy
of
that
data
for
persistency,
and
then
we
try
that
later
so
don't
lose
your
data,
and
then
we
have
this
kind
of
which
is
called
the
output
destinations
is
a
wait.
How
do
I
connect?
A
So
this
is
the
project
that
we
are
speaking
about
today,
which
is
called
fluent
bed
I'm
fluent
bed,
a
separate
which
is
part
of
fluent
e.
Do
we
have
fluent
the
users
flu
MD
yeah?
So
most
of
you
here
familiar
with
20,
okay,
so
flu
embed
itself
is
started
on
2015
flu
in
this
study
on
2011.
If
I'm
not
wrong,
we
have
the
fluency
maintainer.
He
was
here
and
the
originally
flu
embed
was
created
for
embedded
Linux,
but
happened
that
in
the
embedded
market,
people
was
not
so
embedded
in
general.
A
People
do
not
have
really
standards
for
everything.
It's
not
like
in
the
cloud
in
embedded,
every
company
or
every
stack
tried
to
solve
the
problem
on
their
own
way.
Okay,
so
what
I'm
trying
to
say
that
to
embed
got
a
little
bit
of
traction
in
embedded,
but
where
it
got
more
traction
worse
in
the
cloud
space
in
a
cloud
I'm
saying
with
kubernetes
or
different
kind
of
cloud
services,
because
affluent
bid
was
a
sign
it
to
be
more
small,
lightweight
and
more
performant
for
specific
scenarios.
A
Okay,
but
of
course
fluent
bid
is
not
in
the
same
scope
of
Lundie
flu
in
bed.
Wendy
has
like
800
plugins,
so
him
it
has
45,
and
nowadays,
flu
embed
is
widely
adopted
and
it's
been
used
a
lot
in
kubernetes.
Just
in
the
last
10
months,
we
got
like
13
million
deployments
of
flowing
bit
only
yesterday.
It
was
like
a
hand
100,000
or
something,
and
that
is
crazy.
That
means
that
every
Coburn,
it
is
note
that
is
being
deployed.
It's
either
run
in
fluency
or
fluent
bed.
A
A
This
is
not
that
it
is
true,
but
it
depends
of
the
use
case
and
we
have
a
pluggable
architecture
where
you
can
have
a
you,
can
extend
slow
imbed
mean
how
to
extend
in
plugins
in
input
side,
how
to
collect
data
from
new
places
or
how
to
add
new
destinations,
and
we
have
also
built
in
security
through
embed
TLS.
We
provide
a
secure
sockets
and
for
network
I/o.
A
So
how
cool
embed
a
works
internally,
because
we
said
we
have
a
design
of
a
login
pipeline
and
also
we
need
to
take
data
from
one
place
to
another,
so
in
general,
fluent
bit
runs
in
one
single
thread:
it's
like
a
main
process.
We
don't
we
don't
do
multi-threading
stuff,
so
have
one
ever
loop.
That
is
always
trying
to
collect
new
inside
new
events
that
are
happening
so
the
input
plug-ins.
A
For
example,
if
you
consider
a
log
file,
the
log
file,
the
input
plugin,
that
rich
locks
will
read
the
log
and
until
some
point
and
then
flow
in
bit,
will
tell
the
colonel
please.
Let
me
know
when
this
fail.
This
file
is
changing.
If
this
file
is
changing,
send
me
a
notification
and
the
ever
loop
will
get
a
notification.
So
basically
the
email
loop
get
data
from
the
input
plugins.
A
The
input
plugins
pass
the
data
to
the
filters
and
filters
notify
back
the
email
loop
when
the
data
has
been
processed
back
and
then
the
information
is
sent
back
to
the
output
destinations
and
oppo
destinations
can
be
any
plane
that
is
already
implemented
on
flew
embed
here
and
we're
talking
more
technical
things,
because
we
are,
we
assume
that
we
have
some
knowledge
about
fluency
or
fluid
or
logging
in
general,
okay,
so
full
and
bit
internet
processing.
It
can
deal
with
unstructured
and
structured
data.
A
The
the
famous
example
is
structured
data
like
Apache
log
file,
it's
an
instructive
message
and
you
don't
have
a
structure.
Maybe
you
can
read
it,
you
can
understand
it.
There's
an
IP
address,
there's
a
timestamp,
but
after
that
a
for
a
computer
is
just
bite
right.
It's
different
instructor
message:
for
example
JSON,
where
you
have
a
map,
you
have
a
key
and
you
have
a
value,
because
if
you
want
to
do
data
analysis,
you
want
to
do
search
over
specific
keys
that
exist
on
that
record
and
not
the
whole
string.
A
And
if
you
want
to
do
data
processing
and
convert
unstructured
data
to
structured
data,
we
support
different
mechanisms.
One
is
with
regular
expressions.
We
support
Jason
and
LTS
V
and
there's
a
new
one
coming
up
also-
and
we
also
support
time
lookup
resolution
so
when
an
input
plug
in
a
for
some
reason
want
to
ingest
a
look,
a
lock
message
into
flu
embed
what
it
does
it
create
the
notion
of
a
record.
This
is
like
a
local
I'm,
just
an
example,
and
this
Logan
has
two
things.
A
The
first
one
is
a
timestamp
means,
meaning
when
this
was
generated,
and
also
at
the
message
itself,
it
tends
to
be
a
map,
but
the
difference
is
that
internally,
instant
flu,
embed
and
influency
itself,
this
data,
it's
cellulites
a
in
binary
in
a
format
which
is
called
message
back.
Do
you
know
Jason?
Okay
Jason
is
like
human,
readable
data
structure
right,
but
this
is
totally
binary.
What
means
that
binary
is,
if
you
have
a
host
a
lot
of
bytes
and
you
have
a
lot
of
key
values.
A
Do
you
don't
need
to
go
to
each
byte
processing
each
one
to
know
where
this
value
ends
on
the
next?
One
is
a
starting
you
just
ban
jumping
between
positions,
okay,
that
is
not
possible
with
Jason,
but
with
message
back,
which
is
binary,
is
possible,
and
that
helps
you
to
give
you
a
really
good
performance.
A
So
things
get
more
fun
here,
because
everything
that
was
group
here
with
Apache
and
here
with
syslog,
gets
it
to
the
engine,
but
basically
in
the
rotor
and
the
rotor
will
say:
ok
everything
that
match
with
Apache
that
something
will
go
to
output
blogging.
One
everything
that
matches
with
syslog
will
go
to
output
plug
in
two
or
maybe
you
can
send
the
same
thing
to
both
or
many
many
destinations
so
means.
A
If
you
connect
to
Kafka
or
you
use
any
kind
of
cloud
service
provider
for
login,
you
need
to
perform
a
network
operations,
but
from
a
design
perspective.
If
you
know,
if
you
are,
you
developers
will
have
developers
in
the
audience
who's
the
okay.
If
at
some
point
you
create
a
try
to
connect
to
a
service,
you
know
that
you
need
to
create
a
socket
that
socket
connect
to
an
address,
resolve
that
address
and
and
then
wait
until
that
connection
is
established.
And
then
you
can
write
or
send
the
data
to
that
service.
A
A
So
also
we
come
up
with
a
designed
how
to
implement
output
plugins
that
do
not
block
the
whole
process,
so
basically
an
open
plugin.
What
it
does
create
a
TCP
connection
convert
the
internal
message,
a
pack
that
we
so
had
to
the
outgoing
format.
Remember,
for
example,
if
elasticsearch
is
using
JSON
format,
I
need
to
compare
my
own
message.
A
A
pack
that
I
just
explained
it
to
the
JSON
format,
then
write
the
data
over
the
network
then
wait
for
a
response
right,
because
I,
chained,
Asakusa,
HTTP
and
then
report
a
final
status
if
it
was
okay,
it
failed
or
whatever.
So
these
three
things
that
are
in
red
right
now
are
things
that
can
block
my
program,
because,
if
I'm
waiting
to
get
a
response,
why
I'm
blocking
flow
in
bed?
A
What
and
why
I'm
blocking
and
stopping
processing
more
logs
ideal
case
will
be
okay,
I'm
trying
to
make
a
connection,
let
the
kernel
of
the
operating
system.
Please
let
me
know
when
this
is
ready
in
the
main,
while
I'm
going
to
do
my
other
stuff
like
collecting
log
parts
in
filtering
and
notify
me
back
through
my
event
loop,
when
this
is
done.
So
the
design
flow
embed
was
also
to
try
to
avoid
blocking
times
on
here.
A
A
Tray
inside
in
userspace
level,
all
metal
operations
that
means
connect,
write
or
metal
Ryo
in
general
are
abstracted
by
the
fluent
bit
API
to
handle
all
of
these
things
at
TCP
and
TLS
level
means,
if
you
want
to
connect,
for
example,
you're
writing
a
plug-in,
and
you
want
to
connect
to
a
service
who
use
TLS
or
SSL.
Of
course,
you
don't
want
to
do
your
own
manual
handshake.
What
you
do
is
just
use
the
fluent
API
that
provides
you
the
whole
abstraction
for
that
and
in
the
asynchronous
side,
net
or
IO
you
can
suspend
occur.
A
Routine
means
if
I'm,
connecting
to
a
service.
I
can
suspend
on
that
moment
and
resume
later
return
control
to
the
ml
loop
and
when
an
event
happens,
resume
and
continue
working.
So
a
I'm,
not
sure
if
you
are
familiar
with
C
language,
but
this
is
just
like
a
very
simple
output
plug-in
for
fluid
bed.
What
it
does
is
connect
to
elasticsearch,
convert
the
data
and
send
send
the
data
to
a
service.
Okay.
This
is
a
function.
Definition.
Okay,
the
name
is
random.
A
What
we
have
here
on
line
8
it
just
get
a
TCP
connection
to
the
service
that
was
defined
in
the
configuration
we
call
it
an
AB
string,
connection:
okay,
that's
fine!
Then
we
compare
the
format
because
we
have
data
which
is
matched
back
to
the
ongoing
expected
format.
The
function
is
not
here
for
it's
outside
in
a
different
file.
Then
we
create
an
HTTP
client
context
and
then
we
flush
the
data
and
once
we
fetch
the
data
with
return
and
status.
A
So
they
think
is
that
on
this
point,
when
we
create
the
connection-
and
we
when
are
writing
the
data
over
the
network,
we
had
the
whole
source
pane
and
resume
stuff.
So
if
you're
writing
a
plug-in
for
fluent
I
do
rather
like
this,
and
you
always
will
care
about
just
one
return:
error.
Okay,
but
if
you
don't
have
this
schemer,
you
had
to
do
all
the
networking
stuff
on
your
own
plug-in,
and
that
is
quite
complex
and
it's
not
that
easy.
A
A
So
when
the
output
plug-in
ends,
it
needs
what
it
must
to
return
a
value,
it
can
be.
Okay,
we
try
or
an
error
and
okay
means
that
okay
I
was
able
to
flush
the
data
perfect,
the
plugins
just
returned
at
status.
They
don't
handle
retries,
but
if
they
return
back
and
retry
for
the
engine
means.
Oh,
this
plugin
tried
to
deliver
the
locks,
but
for
some
reason
it
failed
by
discuss
asking
to
retry
means,
wait
a
couple
of
seconds
I
will
try
call
me
again
later
to
see
if
a
problem
is
solve.
A
So
if
this
plug-in
has
not
tried
many
times,
because
you
can
put
some
limits
on
it,
it
will
issue
a
lira.
Try
or
maybe
you
can
have
an
error
that
you
cannot
handle,
because
the
message
packet
area
can
be
corrupted
or
any
any
exception,
that
the
plug-in
considered
that
a
the
data
will
not
be
processed
at
the
game.
That's
how
and
the
transferred
data
from
one
point
to
the
other
works.
A
So
when
I
say
that
will
happen,
API
also
I
say
that
we
have
built-in
helpers,
because
if
you
are
developers
you
are
extending
flu
embed.
Do
you
need
to
have
these
things
to
upstream
connections,
something
that
handle
the
connection
for
you?
You
need
to
have
an
HTTP
client,
for
example,
a
the
Microsoft
Azure
service.
If
not
run
sorry
Google
stack
driver
use,
OAuth
2
as
an
authentication
mechanism,
so
we
provide
the
helper
for
that.
A
timers,
crypto
libraries
and
Lua
I'm
going
to
spend
about.
You
are
a
few
seconds.
A
So
this
is
a
list
of
a
few
plugins
that
we
have
implemented
for
the
context
of
the
conference.
What
is
really
important
in
the
input
side
is
still
to
read.
Log
files
systemd
if
you're
running
in
kubernetes
or
the
logs
go
to
the
file
system
or
they
go
to
a
system
D.
So
we
support
both
mechanisms
to
consume
logs
from
in
the
filter
inside
which
is
important
for
kubernetes
case.
A
What
your
filter
will
do
is
like
no
I
need
to
add
some
conditions
for
the
data
if
it's
an
if
and
else
and
then
bla
bla,
bla,
bla,
so
at
very
specific
use
cases,
and
you
cannot
match
a
plug-in
for
something
that
is
very
specific
to
one
user.
So
we
created
a
filter
which
is
called
Lua.
So
you
can
write
your
own
filters
in
a
Lua
script
in
a
configuration
file
and
then
the
filter
will
call
that
we
are
going
to
spray
that
and
as
know
put
destination.
A
Well
we
support
Trisha
data
and
the
services
we
provide
a
HTTP
endpoint
elasticsearch
Splunk
assure
Kafka.
So
so
this
is
like
a
simple
filtered
reading
in
Lua
language.
It's
just
a
function
that
we
get
attacked
the
timestamp
when
this
was
created
and
the
data
this
does
not
come
in
message
back.
It
gets
in
Lua
representation
data,
which
is
called
what
tables.
So
everything
in
the
record
is
like,
like
a
table
like
an
array
with
an
index,
basically
just
with
a
new
record
I,
say
new
record
the
new
key,
but
will
have
this
value.
A
The
old
value
will
have
the
old
record
a
returned
one.
This
the
first
status
code,
means
if
I'm
going
to
delete
the
record,
modify
it
or
just
do
nothing
once
means
I'm
going
to
modify
I,
keep
the
same
time
for
the
record
and
then
just
return
the
new
wreck.
So
if
you
want
to
do
this
and
see
you
will
write
like
200
lines
right,
so
you
can
write
filters
very
easily
in
lua,
and
the
good
thing
about
lure
language
is
that
we
have
a
just-in-time
compiler
for
it.
So
as
of
today,
it
works
fine.
A
A
Ok,
when
you
have
containers
and
applications
running,
you
need
to
process,
the
locks
from
the
pots
are
being
generated
in
the
filesystem,
so
what
you
do
is
to
just
deploy
a
fluent
bit
or
fluent
D,
as
a
daemon
set
demon
set,
is
just
a
pot
that
runs
on
every
node
and
you
just
let
it
flow
and
bed-rid
the
logs
from
the
file
system.
Ok,
this
is
like
a
tail
input
right,
I'm
consuming
the
data,
but
then
you
want
to
obtain
some
metadata
on
the
rich,
those
logs.
A
A
So
a
simple
example:
this
is
like
a
message
that
was
generated
by
the
application.
Joe
could
create
all
this
JSON
map,
with
a
key
called
lock
with
a
string
called
standard
output
and
a
timestamp.
But
after
that
there
is
filtered.
Do
you
get
this
because
you
get
the
whole
notion
about?
What's
the
pot
name
that
this
Rick
was
created?
What
is
the
container
name?
The
namespace,
the
host
and
so
on.
A
One
of
the
features
of
fluent
bit
specifically
for
kubernetes
is
that
people
said
eh
when
you're
running
applications,
maybe
you're
deploying
Apache,
maybe
a
deploying
nginx
or
any
application,
has
a
different
format
for
logging.
Okay,
but
in
kubernetes
we
needed
to
have
a
way
to
say.
If
you
are
deploying
a
pod
and
applications
say,
please
use
a
parcel
apart,
because
many
application
is
running
Apache,
so
we
implemented
this
kind
of
annotation
for
fluent
path,
where
you
can
define
your
own
parser.
A
Of
course,
this
person
exists
on
fluent
bit
configuration
before
and
also
this
future
just
got
expanded
a
little
bit
more
few
weeks
ago.
With
your
also
you
a
notation
you
can
say,
because
in
one
pot
you
can
have
many
containers
and
many
containers
can
come
direct
from
different
streams.
So
now
you
can
make
an
annotation
saying
please
a
parcel
for
this
container
name
on
the
dis
stream.
A
Nail
use
this
parcel
or
for
the
part
said
that
on
this
container
this
person,
so
you
can
use
any
option
that
you
want
and
also
we
have
an
option
which
is
called
exclude,
because
you
are
deploying
a
pod
that
you
don't
care
about
the
locks
of
that
pod
and
you
want
to
exclude
it
so
flu
in
bed
when
correlated
data,
goes
to
the
API
server
and
get
the
annotations
will
say.
Oh
this
pot
is
being
asked
to
be
secluded,
so
I'm
going
to
stop
processing
the
logs
from
that
pot.
A
Also
and
flowing
bid
will
provide
a
way
to
measure
how
things
are
working
internally.
A
actually
are
you
familiar
with
primitives,
okay
parameters.
This
away
is
a
solution
to
gather
metrics
from
services
and
aggregated
metrics.
You
have
log
in
and
you
have
metrics
logging
floandlew
embed,
metrics
primitives.
So
with
this
way,
we
are
low
that
you
can
put
your
own
primitives
and
pull
metrics
from
flu
and
bit
to
try
to
realize
how
many
records
are
being
processed
per
second
or
gather
your
own
metrics.
A
And
now
we
are
preparing
for
flu
in
bed,
one
that
o
to
be
release
on
December
on
cube
con
and
one
of
the
specific
features
that
people
were
asking
a
lot
about.
It
is
file
system
buffering
when
you
are
processing
the
data
I
mentioned
in
the
beginning
that
you
have
buffering
right
by
by
default.
The
buffering
is
just
in
memory.
A
For
example,
flu
in
D
was,
from
the
beginning,
has
buffering
the
file
system
and
in
memory
and
why
you
have
you
want
to
have
two
different
buffering
mechanisms,
because
sometimes,
if
you
are
flushing,
the
data
out
to
a
for
example,
elasticsearch
and
elasticsearch
is
not
working
fast
enough.
You
get
what
is
called
back
pressure
because
you
cannot
send
your
data,
so
you
did
a
get
before
it,
but
also
you
are
consuming
more
data,
so
you're
blocking
and
at
some
point
you
need
to
put
that
data
somewhere.
A
If
you
put
that
on
memory
and
elasticsearch
is
always
down
your
process
will
crash
or
you
will
wanna
get
get
killed,
but
instead
what
everybody
does
in
production
is
to
use
the
file
system
because
people
say
no
doesn't
matter.
I
have
like
ten
gigabytes
in
the
file
system,
I'm
going
to
use
that
as
a
buffer.
So
if
Thomson
something
happens,
I
continue
buffering
in
the
file
system,
a
write,
optional
plugins
as
shared
libraries,
as
of
now
flow
and
betas,
really
in
C
language
and
all
plugins
are
linked
it
statically.
A
So
the
new
change
is
that
they
will
become
like
share
libraries,
the
community's
filter
continuum
and
getting
more
improvements,
because
we
always
get
more
more
ideas.
Yesterday,
we
were
asked
to
take
the
kubernetes
flow
filter.
They
said
we
work
for
Google,
okay,
we
are
use
flow,
Andy,
that's
perfect,
but
we
want
to
start
experiment
with
to
embed.
But
the
thing
is
that
when
we
provide
the
kubernetes
cluster
to
our
users,
our
users
don't
have
a
way
to
exclude
logs
or
just
look
special,
but
that
belongs
or
have
special
labels.
A
So
we
are
going
to
provide
special
ways
to
say
any.
Look.
That's
coming
from
a
specific
Google,
this
label
just
drop
it
or
just
let
it
pass
and
well.
This
is
already
done
static
configuration
mode.
This
is
mostly
for
a
embedded
stuff
where
sometimes
the
services,
thoughts
or
the
system.
One
is
run
in
fluent
bit,
doesn't
have
a
file
system,
so
you
cannot
provide
a
configuration
file,
so
you
just
make
the
configuration
inside
the
same
binary
or
executable.
A
B
B
However,
for
kubernetes,
as
you
mentioned
previously
in
you,
can
only
monitor
the
file
system,
which
means
you,
you
need
to
collect
all
the
logs
in
the
entire
kubernetes
cluster.
However,
this
is
not
possible
for
us,
because
sometimes
our
customer
deploy
the
application
into
a
shared
kubernetes
cluster,
so
we
don't
want
them
to
collect
and
non-relevant
application
logs
within
this
cluster.
So
is
there
any
solution
to
this
problem.
A
So
there
is
a
design
problem
looks
like
at
the
same
problem
because,
okay,
you
have
a
shared
environment
and
you
don't
want
to
provide
one
logging
tool
for
the
whole
user
thread
we
want
to
isolate.
So
the
way
to
isolate
is
with
namespaces.
The
way
to
isolate
is
with
labels,
so
you
can
configure.
The
log
processor
can
be
flew
into
your
flew
in
bit
and
just
say,
process
the
low
that
belong
to
a
specific
namespace.
A
B
Do
you
mean
that?
Because
you
mentioned
that
an
flew
MP
and
can
be
configured
to
monitor
the
file
system,
but
in
that
case
I,
don't
think
it
can
be
retrieved
the
metadata
from
kubernetes
because
of
isotones
owning,
contains
some,
let's
say,
for
example,
a
b
c
d
da
log
file
within
the
file
system.
Now.
A
But
that
is
the
filter
job.
So
don't
worry.
If
you
look
at
the.
If
you
look
at
any
cluster
and
you
go
to
the
container
locks,
you
will
see
that
each
container
log
contains
the
port
name,
the
container
ID
and
the
namespace
name,
and
that
is
formation
is
processed
by
for
in
D
or
flew
in
bed
and
goes
to
the
API
server
to
gather
the
right
material.
So.
C
Had
a
question
about
the
output
plug-in
system,
so
I
think
you
mentioned,
there's
three
states
the
plug-in
has
to
return.
One
of
them
was
a
hole
so
that,
basically,
if
an
initially
correctly
means
like
for
that
output,
we're
giving
up
this
log-
and
you
don't
need
to
try
again-
is
that
correct,
yeah.
C
C
Because
I
was
thinking
like
in
a
case
suppose
I
have
like
multiple
outputs,
only
one
of
them.
Maybe
the
consumer
is
having
a
problem
right,
so
I
believe
if
I
just
keep.
If
all
the
plugins
keep
returning
retry,
then
I
and
I
believed
the
default
behavior
for
20
would
be
to
just
buffer
everything.
Until
all
of
the
outputs
are
okay,
yeah.
A
Yeah,
it
depends
because
fluent
D
in
the
buffering
mechanism,
flew
in
D,
is
different.
A
fluent
bit.
Okay
in
fluently
the
buffer
exists
at
the
output
side
of
the
queues
that
output
queues,
so
the
data
can
be
replicated
if
an
output
plug-in
already
created
some
a
some
special
data
to
flush
formatted
data.
That
data
is
in
the
buffer.
Okay,
in
fluent
babe,
we
always
reformat
the
data
every
time
that
we're
going
to
the
try.
A
C
C
A
C
A
C
A
Actually,
in
fluent
it,
the
plugins
doesn't
happen
notion
about
if
they
are
going
to
be
retry
or
not,
that
is
handled
by
the
scheduler
in
the
engine.
Okay,
so
the
plug-in
just
know
how
to
get
the
data
format,
the
data
and
flush
the
data
and
return
a
value.
Okay
got
it
that
is
up
to
the
engine.
Otherwise
you
give
too
much
power
to
the
plugins.
Okay,
that's
better
to
have
control
over
that.
Okay,
just.
A
We
created
an
extension
last
year
about
write
output,
plugins
single,
but
it
works,
but
the
just
works.
The
problem
is
that
when
you
have
C
code,
then
you
connect
to
the
Golan
world.
Okay,
your
C
code
goes
out
of
the
scope
because
it's
a
suite
to
set
context
which
you
know
go
align
take
cares
about
that.
So
the
login
process
is
stopped
working
and
then
it
just
recovered
when
the
goal-
and
we
don't
the
control
back
to
flu
embed.