Skip to content

DOCS-3052: Hold Fluent Bit and eBPF v5.17 back from Calico Cloud next #3094

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ctauchen merged 1 commit into from
Oct 12, 2026
Merged

DOCS-3052: Hold Fluent Bit and eBPF v5.17 back from Calico Cloud next #3094

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion calico-cloud/_includes/components/ReqsSys.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,7 @@ function NetworkRequirementsEnt(props) {
<td>
<strong>Logs and storage</strong>
</td>
<td>Elasticsearch log storage</td>
<td>Elasticsearch with fluentd datastore</td>
<td>TCP 9200 (default)</td>
</tr>
<tr className='odd'>
Expand Down
6 changes: 3 additions & 3 deletions calico-cloud/get-started/cc-arch-diagram.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,16 @@
| $[prodname] installer | Gets installation resources from the $[prodname] portal, registers a managed cluster, and reports installation or upgrade progress. | &bull; TCP 443 to $[prodname] hosted service<br />&bull; TCP 6443 to Kubernetes API server |
| $[prodname] tunnel server | Communicates with managed clusters by creating secure TLS tunnels. | Port 9000 from managed clusters |
| calico-node | Bundles key components that are required for networking containers with $[prodname]:<br/><br />&bull; Felix<br />&bull; BIRD<br />&bull; confd | &bull; TCP 5473 to Typha<br />&bull; TCP 9900 and 9081 from Prometheus API service |
| Compliance | Generates compliance reports for the Kubernetes cluster. Reports are based on archived flow and audit logs for Calico Cloud resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information:<br /><br />&bull; Endpoints explicitly protected using ingress or egress policy<br />&bull; Policies and services<br /> - Policies and services associated with endpoints<br /> - Policy audit logs <br />&bull; Traffic<br /> - Allowed ingress/egress traffic to/from namespaces, and to/from the internet Compliance includes these components: <br /><br />**compliance-snapshotter** <br />Handles listing of required Kubernetes and $[prodname] configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval.<br /><br />**compliance-reporter**<br />Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services, and network sets. Data is then passed through a zero-trust aggregator to determine the “worst-case outliers” in the reporting interval.<br /><br />**compliance-controller**<br />Reads report configuration and manages creation, deletion, and monitoring of report generation jobs.<br /><br />**compliance-benchmarker**<br />A DaemonSet that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed.<br /> | &bull; TCP 8080 to Guardian<br />&bull; TCP 6443 to Kubernetes API server |
| Fluent Bit | Open-source, lightweight log processor and forwarder. Collects and forwards $[prodname] logs (flows, DNS, L7) to log storage. | &bull; TCP 8080 to Guardian<br />&bull; TCP 2020 from Prometheus API service |
| Compliance | Generates compliance reports for the Kubernetes cluster. Reports are based on archived flow and audit logs for Calico Cloud resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information:<br /><br />&bull; Endpoints explicitly protected using ingress or egress policy<br />&bull; Policies and services<br /> - Policies and services associated with endpoints<br /> - Policy audit logs <br />&bull; Traffic<br /> - Allowed ingress/egress traffic to/from namespaces, and to/from the internet Compliance includes these components: <br /><br />**compliance-snapshotter** <br />Handles listing of required Kubernetes and $[prodname]configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval.<br /><br />**compliance-reporter**<br />Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services, and network sets. Data is then passed through a zero-trust aggregator to determine the “worst-case outliers” in the reporting interval.<br /><br />**compliance-controller**<br />Reads report configuration and manages creation, deletion, and monitoring of report generation jobs.<br /><br />**compliance-benchmarker**<br />A daemonset that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed.<br /> | &bull; TCP 8080 to Guardian<br />&bull; TCP 6443 to Kubernetes API server |

Check warning on line 34 in calico-cloud/get-started/cc-arch-diagram.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'DaemonSet' instead of 'daemonset'.

Raw Output:
{"message":"[Vale.Terms] Use 'DaemonSet' instead of 'daemonset'.","location":{"path":"calico-cloud/get-started/cc-arch-diagram.mdx","range":{"start":{"line":34,"column":1533},"end":{"line":34,"column":1542}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Check failure on line 34 in calico-cloud/get-started/cc-arch-diagram.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'PICKLEVARconfiguration'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'PICKLEVARconfiguration'?","location":{"path":"calico-cloud/get-started/cc-arch-diagram.mdx","range":{"start":{"line":34,"column":767},"end":{"line":34,"column":789}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}
| Fluentd | Open-source data collector for unified logging. Collects and forwards $[prodname] logs (flows, DNS, L7) to log storage. | &bull; TCP 8080 to Guardian<br />&bull; TCP 9080 from Prometheus API service |
| Guardian | An agent running in each managed cluster that proxies communication between the $[prodname] tunnel server and your managed cluster. Secured using TLS tunnels.<br /> | &bull; Port 9000 to tunnel server<br />&bull; TCP 6443 to Kubernetes API server<br />&bull; TCP 6443 from $[prodname] components |
| Installation endpoints | Endpoints at `*.calicocloud.io` and `*.projectcalico.org`. | TCP 443 for both |
| Intrusion detection controller | Handles integrations with threat intelligence feeds and $[prodname] custom alerts. | &bull; TCP 8080 to Guardian<br />&bull; TCP 6443 to Kubernetes API server |
| Kubernetes API server | A Kubernetes component that validates and configures data for the API objects (for example, pods, services, and others). <br /> | TCP 6443 (from all components) |
| kube-controllers | Monitors the Kubernetes API and performs actions based on cluster state. $[prodname] kube-controllers container includes these controllers:<br/><br />&bull; Node<br />&bull; Service<br />&bull; Federated services<br />&bull; Authorization<br /> | &bull; TCP 9094 from Prometheus API service<br />&bull; TCP 6443 to Kubernetes API server |
| Log storage | Storage for logs (flows, L7, DNS, audit). Data for each managed cluster is isolated and protected against unauthorized access. | n/a |
| Packet capture API | Retrieves capture files (pcap format) generated by a packet capture for use with network protocol analysis tools like Wireshark. Packet capture data is visible in the web console and Service Graph. | &bull; TCP 8449 Guardian to Packet Capture API<br />&bull; TCP 6443 to Kubernetes API server |
| Prometheus API service | Collects metrics from $[prodname] components and makes the metrics available to the web console. | &bull; TCP 6443 to Kubernetes API server<br />&bull; TCP 2020 to Fluent Bit<br />&bull; TCP 9900 and 9081 to Prometheus API service |
| Prometheus API service | Collects metrics from $[prodname] components and makes the metrics available to the web console. | &bull; TCP 6443 to Kubernetes API server<br />&bull; TCP 9080 to Fluentd<br />&bull; TCP 9900 and 9081 to Prometheus API service |
| Tigera API server | Allows users to manage $[prodname] resources such as policies and tiers through kubectl or the Kubernetes API server. | &bull; TCP 9095 to Prometheus API service<br />&bull; TCP 8080 from Kubernetes API server |
| Typha | Increases scale by reducing each node’s impact on the datastore. | TCP 5473 from calico-node to Typha |
| User access to the web console | Authenticated users can access the browser-based the web console, which provides network traffic visibility and troubleshooting, centralized multi-cluster management, threat-defense, policy lifecycle management, and compliance for multiple roles/stakeholders. | Port 443 to $[prodname] tunnel server |
28 changes: 14 additions & 14 deletions calico-cloud/get-started/operator-checklist.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@

**Sample output**

In the following example, the `typha` component has an issue because it is showing `AVAILABLE: FALSE`, and `DEGRADED: TRUE`. To understand details of $[prodname] components, see [Deep dive into custom resources](#deep-dive-into-custom-resources).
In the following example, the typha component has an issue because it is showing `AVAILABLE: FALSE`, and `DEGRADED: TRUE`. To understand details of $[prodname] components, see [Deep dive into custom resources](#deep-dive-into-custom-resources).

Check warning on line 85 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Typha' instead of 'typha'.

Raw Output:
{"message":"[Vale.Terms] Use 'Typha' instead of 'typha'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":85,"column":31},"end":{"line":85,"column":36}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

```yaml
apiVersion: v1
Expand Down Expand Up @@ -387,9 +387,9 @@
| 7 | management-cluster-connection | TRUE | FALSE | FALSE | 9m54s |
| 8 | monitor | TRUE | FALSE | FALSE | 11m |

**1 - API server**
**1 - api server**

Check warning on line 390 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'API' instead of 'api'.

Raw Output:
{"message":"[Vale.Terms] Use 'API' instead of 'api'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":390,"column":7},"end":{"line":390,"column":10}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

`apiserver` is a required component that is an aggregated API server. It is required for things like applying the Tigera license. If `tigerastatus` reports it as unavailable or degraded, check the pods and logs in the `calico-system` namespace. For example,
`apiserver` is a required component that is an aggregated api-server. It is required for things like applying the tigera license. If `tigerastatus` reports it as unavailable or degraded, check the pods and logs in the `calico-system`namespace. For example,

Check warning on line 392 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Tigera' instead of 'tigera'.

Raw Output:
{"message":"[Vale.Terms] Use 'Tigera' instead of 'tigera'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":392,"column":115},"end":{"line":392,"column":121}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Check warning on line 392 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'API' instead of 'api'.

Raw Output:
{"message":"[Vale.Terms] Use 'API' instead of 'api'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":392,"column":59},"end":{"line":392,"column":62}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

```bash
kubectl get pods -n calico-system
Expand Down Expand Up @@ -470,19 +470,19 @@

**6 - log-collector**

`log-collector` collects flow and other logs and forwards them to $[prodname]. Check the `calico-fluent-bit` pods and logs in the `calico-system` namespace. You should have one pod running on each of your nodes.
`log-collector` collects flow and other logs and forwards them to $[prodname]. Check the pods and logs in the `tigera-fluentd` namespace. You should have one pod running on each of your nodes.

```bash
kubectl get pods -n calico-system -l k8s-app=calico-fluent-bit
kubectl get pods -n tigera-fluentd
```

```
NAME READY STATUS RESTARTS AGE
calico-fluent-bit-5mzh6 1/1 Running 0 70m
calico-fluent-bit-7vmxw 1/1 Running 0 70m
calico-fluent-bit-bbc4p 1/1 Running 0 70m
calico-fluent-bit-chfz4 1/1 Running 0 70m
calico-fluent-bit-d6f56 1/1 Running 0 70m
NAME READY STATUS RESTARTS AGE
fluentd-node-5mzh6 1/1 Running 0 70m
fluentd-node-7vmxw 1/1 Running 0 70m
fluentd-node-bbc4p 1/1 Running 0 70m
fluentd-node-chfz4 1/1 Running 0 70m
fluentd-node-d6f56 1/1 Running 0 70m
```

**7 - management-cluster-connection**
Expand Down Expand Up @@ -534,7 +534,7 @@

**8 - monitor**

`monitor` is responsible for configuring Prometheus and associated custom resources. Check the pods and logs in the `tigera-prometheus` namespace.
`monitor` is responsible for configuring prometheus and associated custom resources. Check the pods and logs in the `tigera-prometheus` namespace.

Check warning on line 537 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.

Raw Output:
{"message":"[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":537,"column":42},"end":{"line":537,"column":52}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

```bash
$ kubectl get pods -n tigera-prometheus
Expand Down Expand Up @@ -607,8 +607,8 @@

The high-level components $[prodname] needs to run are:

- Per node: 1 `fluent-bit`, 1 `compliance-benchmarker`
- On top of per node: 3 `alertmanager` (from StatefulSet), 1 `prometheus`, 1 `prometheus` operator, 1 kube-controllers, 2 compliance snapshotter and controller, 1 guardian, 1 ids controller, 1 `apiserver`
- Per node: 1 fluentd, 1 compliance benchmarker

Check failure on line 610 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'benchmarker'?

Raw Output:
{"message":"[Vale.Spelling] Did you really mean 'benchmarker'?","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":610,"column":37},"end":{"line":610,"column":48}}},"severity":"ERROR","code":{"value":"Vale.Spelling"}}

Check warning on line 610 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Fluentd' instead of 'fluentd'.

Raw Output:
{"message":"[Vale.Terms] Use 'Fluentd' instead of 'fluentd'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":610,"column":15},"end":{"line":610,"column":22}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}
- On top of per node: 3 alertmanager (from statefulset), 1 prometheus, 1 prometheus operator, 1 kube-controllers, 2 compliance snapshotter and controller, 1 guardian, 1 ids controller, 1 apiserver

Check warning on line 611 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.

Raw Output:
{"message":"[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":611,"column":74},"end":{"line":611,"column":84}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Check warning on line 611 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.

Raw Output:
{"message":"[Vale.Terms] Use 'Prometheus' instead of 'prometheus'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":611,"column":60},"end":{"line":611,"column":70}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Check warning on line 611 in calico-cloud/get-started/operator-checklist.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Alertmanager' instead of 'alertmanager'.

Raw Output:
{"message":"[Vale.Terms] Use 'Alertmanager' instead of 'alertmanager'.","location":{"path":"calico-cloud/get-started/operator-checklist.mdx","range":{"start":{"line":611,"column":25},"end":{"line":611,"column":37}}},"severity":"WARNING","code":{"value":"Vale.Terms"}}

Some clusters have limited pod-networked pod capacity.

Expand Down
31 changes: 4 additions & 27 deletions calico-cloud/observability/elastic/archive-storage.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,29 +71,6 @@ Because $[prodname] and Kubernetes logs are integral to $[prodname] diagnostics,
kubectl edit logcollector tigera-secure
```

$[prodname] writes one directory per log type under `bucketPath`, and names each object
for the UTC day it covers:

```
<bucketPath>/flows/20260101_<uuid>.gz
<bucketPath>/dns/20260101_<uuid>.gz
<bucketPath>/l7/20260101_<uuid>.gz
<bucketPath>/audit_kube/20260101_<uuid>.gz
<bucketPath>/audit_tsee/20260101_<uuid>.gz
```

Flow logs from non-cluster hosts are archived under `non_cluster_flows/` instead of
being mixed into `flows/`.

:::note

If you are upgrading from a release that collected logs with Fluentd, these keys have
changed. Fluentd wrote flat keys with the date concatenated onto the log type, as in
`<bucketPath>/flows20260101_1.gz`. Update any downstream tooling that matches the old
pattern.

:::

</TabItem>
<TabItem label="Syslog" value="Syslog-1">

Expand All @@ -111,8 +88,8 @@ Because $[prodname] and Kubernetes logs are integral to $[prodname] diagnostics,
syslog:
# (Required) Syslog endpoint, in the format protocol://host:port
endpoint: tcp://1.2.3.4:514
# (Optional) Maximum message size in bytes. Defaults to 2048.
packetSize: 2048
# (Optional) If messages are being truncated set this field
packetSize: 1024
# (Required) Types of logs to forward to Syslog (must specify at least one option)
logTypes:
- Audit
Expand Down Expand Up @@ -158,8 +135,8 @@ Because $[prodname] and Kubernetes logs are integral to $[prodname] diagnostics,
syslog:
# (Required) Syslog endpoint, in the format protocol://host:port
endpoint: tcp://1.2.3.4:514
# (Optional) Maximum message size in bytes. Defaults to 2048.
packetSize: 2048
# (Optional) If messages are being truncated set this field
packetSize: 1024
# (Optional) To Configure TLS mode
encryption: TLS
# (Required) Types of logs to forward to Syslog (must specify at least one option)
Expand Down
57 changes: 26 additions & 31 deletions calico-cloud/observability/elastic/dns/filtering-dns.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,12 @@
---
description: Suppress low-value Calico Cloud DNS log entries with Fluent Bit filters configured through a ConfigMap in the operator namespace of connected clusters.
description: Suppress low-value Calico Cloud DNS log entries with Fluentd filters configured through a ConfigMap in the operator namespace of connected clusters.
---

# Filter DNS logs

$[prodname] supports filtering out DNS logs based on user provided
configuration. Use filtering to suppress logs of low significance.

## Before you begin

**Required**

If you already filter DNS logs, migrate your filters before you upgrade. Earlier releases collected logs with Fluentd and read filters written in Fluentd `<filter>` syntax from a ConfigMap named `fluentd-filters`. $[prodname] now collects logs with Fluent Bit, which does not read that ConfigMap and cannot translate Fluentd syntax. Rewrite each filter as a Fluent Bit filter list using the steps on this page, and create it in a ConfigMap named `fluent-bit-filters`.

Until you do, $[prodname] ships DNS logs unfiltered, which increases your log volume and storage costs. If a key in `fluent-bit-filters` is not valid Fluent Bit YAML, $[prodname] skips that key, keeps shipping unfiltered logs, and reports a warning naming the key:

```bash
kubectl get tigerastatus log-collector -o yaml
```

**Limitations**

Filters apply to logs collected from Linux nodes. The Windows log collector does not read them.

## Configure DNS filtering

DNS log filtering is configured through a ConfigMap in the `tigera-operator`
Expand All @@ -34,35 +18,46 @@ To enable DNS log filtering, follow these steps:
your desired filter using [Filter configuration files](#filter-configuration-files).
If you are also adding [flow filters](../flow/filtering.mdx) also add the `flow` file
to the directory.
1. Create the `fluent-bit-filters` ConfigMap in the `tigera-operator` namespace
1. Create the `fluentd-filters` ConfigMap in the `tigera-operator` namespace
with the following command.
```bash
kubectl create configmap fluent-bit-filters -n tigera-operator --from-file=filters
kubectl create configmap fluentd-filters -n tigera-operator --from-file=filters
```

The operator inserts the filters inline into the log collector configuration and rolls the
`calico-fluent-bit` DaemonSet automatically.

## Filter configuration files

Each file holds a YAML list of [Fluent Bit filter](https://docs.fluentbit.io/manual/data-pipeline/filters/) entries. The `calico-fluent-bit` log collector ships four Fluent Bit filters — [`grep`](https://docs.fluentbit.io/manual/data-pipeline/filters/grep), [`record_modifier`](https://docs.fluentbit.io/manual/data-pipeline/filters/record-modifier), [`parser`](https://docs.fluentbit.io/manual/data-pipeline/filters/parser), and [`lua`](https://docs.fluentbit.io/manual/data-pipeline/filters/lua) — and no others. The examples below use `grep`. Filters in the `dns` file are applied to DNS logs automatically; you do not need to set a `match` on each entry. For the fields you can filter on, see the [DNS log schema](dns-logs.mdx).
The filters defined by the ConfigMap are inserted into the fluentd configuration file.
The [upstream fluentd documentation](https://docs.fluentd.org/filter/grep)
describes how to write fluentd filters. The [DNS log schema](dns-logs.mdx) can be referred to
for the specification of the various fields you can filter based on. Remember to ensure
that the config file is properly indented in the ConfigMap.

## Example 1: filter out cluster-internal lookups

This example filters out lookups for domain names ending with ".cluster.local". More
logs could be filtered by adjusting the regular expression, or by adding
additional `exclude` rules.
logs could be filtered by adjusting the regular expression "pattern", or by adding
additional `exclude` blocks.

```yaml
- name: grep
exclude: qname \.cluster\.local$
```
<filter dns>
@type grep
<exclude>
key qname
pattern /\.cluster\.local$/
</exclude>
</filter>
```

## Example 2: keep logs only for particular domain names

This example will filter out all logs _except_ those for domain names ending `.co.uk`.

```yaml
- name: grep
regex: qname \.co\.uk$
```
<filter dns>
@type grep
<regexp>
key qname
pattern /\.co\.uk$/
</regexp>
</filter>
```
Loading
Loading