Papertrail's "system" and "program" not propagated to logs?

[jtomaszewski]

We had setup this a couple of days ago and logs were nicely showing ${KS_NAMESPACE}/${KS_CONTAINER_NAME} as "system" and description of the k8s node & pod as "program" in the papertrail logs:

However after we tried setting this up again a few days later, it somehow works differently now for us:

Compare the screenshots - now the k8s node, pod, namespace and container names are included in the log text (as white text), rather than as system/program tag.

We preferred the previous behaviour. Any idea how we can make it work as it did initially?

[miguel-callejas-seagull-com]

I'm exactly in the same place. I saw the previous format was coming from:

		payload := &papertrailgo.Payload{
			Hostname: fmt.Sprintf("%s/%s", ev.Source().Namespace(), ev.Source().Container()),
			Tag:      fmt.Sprintf("rkubelog/node(%s)/pod(%s)", ev.Source().Node(), ev.Source().Name()),
			Log:      string(ev.Log()),

But in version r18, the log is coming from the Entrypoint call: /app/rkubelog in our case.
What I ended up doing is to rollback to r16 (where it's working and fork it with better naming conventions). Similar to the ones exported by logspout.

[jtomaszewski]

Thanks. Rolling back to r16 fixed the issue for us. I guess that commit is the cause: 45c9010 . @turbo , could you give some comment what was the intention of that commit?

Not sure if we should revert it, improve it, or make the behaviour somehow customizable.

[jtomaszewski]

Just spotted, this probably is the same issue as #24 .

[jannesaarinen]

I think this should be fixed. Logs are in completely different format in Papertrail when switching from r17 -> r18 or above.

[hholst80]

I liked the idea but I think it is going against the normal conventions in logging, or at least it will not be for everyone.
We use one deployment of K8s per customer, and every customer use default namespace and this will create a name clash

Edit:

The r19rc format is, as I understand it,

{NAMESPACE}/{CONTAINER} {NODE}/{POD}

and while this does make sense looking at what varies the least it will create a clash for us. However, the r16 format was not optimal either. The r16 format is, as I understand it,

{POD} {NODE}/{NAMESPACE}/{CONTAINER}

If this was fully customizable I would maybe try out

{NODE}/{CONTAINER} {NAMESPACE}/{POD}

or maybe even dropping the {NAMESPACE} in our case since all our services are running in the same namespace, it adds no information.

Since the k8s node names and also the container names are reasonable static but the pod names are transient.