Reading JSON key + value (bool) for log routing?

[jayrlowe]

I'm running Fluentbit in AWS on an EKS Fargate setup. What I'm trying to do is route logs to kinesis based on a json key and value. I tried to do this based on rewrite tag, and it does work, but only for Rule $jsonPayload['test3'] ^permissions_v1$ permissions true

I believe the issue is because I'm trying to use a bool in the regex field like Rule $jsonPayload['test1'] ^true$ test1 true is there any way I can get this working with a bool?

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-logging
  namespace: aws-observability
data:
  flb_log_cw: "true"
  filters.conf: |
    [FILTER]
        Name parser
        Match *
        Key_name log
        Parser crio

    [FILTER]
        Name parser
        Match *
        Key_name log
        Parser json

    [FILTER]
        Name kubernetes
        Match kube.*
        Merge_Log On
        Keep_Log Off
        Buffer_Size 0
        Kube_Meta_Cache_TTL 300s
        Annotations Off

    [FILTER]
        Name rewrite_tag
        Match kube.*
        Emitter_Name kinesis_logs
        Rule $jsonPayload['test1'] ^true$ kinesis.test1 true
        Rule $jsonPayload['test2'] ^true$ kinesis.test2 true
        Rule $jsonPayload['test3'] ^permissions_v1$ kinesis.permissions true

  parsers.conf: |
    [PARSER]
        Name crio
        Format Regex
        Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>P|F) (?<log>.*)$
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

    [PARSER]
        Name json
        Format json
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

  output.conf: |
    [OUTPUT]
        Name cloudwatch_logs
        Match kube.*
        region us-east-1
        log_group_name test-logs
        log_stream_prefix test-
        log_retention_days 60
        auto_create_group true

    [OUTPUT]
        Name kinesis_streams
        Match kinesis.*
        region us-east-1
        stream test-stream

[patrick-stephens]

Not at the moment, the workaround is to convert the types to strings with a LUA filter or similar - you could also use this to just drop based on that value as well rather than use a grep.