diff --git a/gdi/opentelemetry/collector-kubernetes/install-k8s.rst b/gdi/opentelemetry/collector-kubernetes/install-k8s.rst index 064e89b13..7ccb0f2dc 100644 --- a/gdi/opentelemetry/collector-kubernetes/install-k8s.rst +++ b/gdi/opentelemetry/collector-kubernetes/install-k8s.rst @@ -72,7 +72,7 @@ Depending on your destination, you need: * ``splunkObservability.accessToken``. Your Splunk Observability Cloud org access token with ingest authorization scope. See :ref:`admin-org-tokens`. * ``splunkObservability.realm``. Splunk realm to send telemetry data to. The default is ``us0``. See :new-page:`realms `. -.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index. +.. note:: The Collector for Kubernetes uses ``main`` as the default Splunk platform index. You can use annotations to send data to different indexes. See :ref:`kubernetes-config-logs-annotations-indexes` for more information. Deploy the Helm chart ============================================== diff --git a/gdi/opentelemetry/collector-kubernetes/kubernetes-config-logs.rst b/gdi/opentelemetry/collector-kubernetes/kubernetes-config-logs.rst index 59d86e47d..4859f09f6 100644 --- a/gdi/opentelemetry/collector-kubernetes/kubernetes-config-logs.rst +++ b/gdi/opentelemetry/collector-kubernetes/kubernetes-config-logs.rst @@ -8,7 +8,6 @@ Collect logs and events for the Collector for Kubernetes .. meta:: :description: Configure logs and events for the Splunk Distribution of OpenTelemetry Collector for Kubernetes. - .. note:: See how to configure the Collector for Kubernetes at :ref:`otel-kubernetes-config` and :ref:`otel-kubernetes-config-advanced`. Starting on version 0.86.0, the Splunk Distribution of the Collector for Kubernetes collects native OpenTelemetry logs by default. @@ -77,10 +76,17 @@ To process multi-line logs, add the following section to your values.yaml config Use :new-page:`regex101 ` to find a Golang regex that works for your format and specify it in the config file for the config option ``firstEntryRegex``. +.. _kubernetes-config-logs-annotations: + Manage log ingestion using annotations =========================================================================== -Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to. Pod annotation will take precedence over namespace annotation when both are annotated. +.. _kubernetes-config-logs-annotations-indexes: + +Send logs to different indexes +----------------------------------------------------- + +The Collector for Kubernetes uses ``main`` as the default Splunk platform index. Use the ``splunk.com/index`` annotation on pods or namespaces to indicate which Splunk platform indexes you want to send logs to. For example, to send logs from the ``kube-system`` namespace to the ``k8s_events`` index, use the command: @@ -88,6 +94,8 @@ For example, to send logs from the ``kube-system`` namespace to the ``k8s_events kubectl annotate namespace kube-system splunk.com/index=k8s_events +.. note:: A pod annotation takes precedence over a namespace annotation when both are annotated. + Filter logs using pod or namespace annotations ----------------------------------------------------- diff --git a/logs/processors.rst b/logs/processors.rst index 9deada535..c7d64f892 100644 --- a/logs/processors.rst +++ b/logs/processors.rst @@ -41,6 +41,9 @@ Going forward after the transition to Log Observer Connect, you can process data * - Data Stream Processor - See :new-page:`Use the Data Stream Processor `. + * - Ingest Processor + - See :new-page:`About Ingest Processor `. + Prepackaged processing rules =============================================================================