Distinguish init continer logs from specialised container logs to use for fluent filter

[iam432]

Hello All,
I am working on a use case implementation where I need to distinguish init container logs from specialized container logs in a pod object, we are capturing logs in a directory (both syslogs and journal) and we are using fluentbit as log forwarder, whereas in logs I can see entry with container name and can use it for filter but I need to implement this as central use case where different use case has different name for init container, so I am looking for a keyword common for every init container which we can use for filtering.

Thanks
Krishna

[patrick-stephens]

I suspect init containers are logged exactly the same as non-init containers.
It may be better to enforce the naming in your actual deployment either directly or with something like an admission controller to let you find it - you could also use labels/annotations too to indicate it.
The init container logs will always be before the non-init container logs of course but if you have multiple of both it may not be obvious.

[iam432]

Hi Patrick,
Thank you for the response, we can try your advice of adding init container name to have init keyword in it, we already had quite few (more than 100+) applications already running with init pods without init key word in the container name,
When you are suggesting labels in yaml defination, are you referring to labeling containers ? can we do labeling to container ? I tried it but object creation fails with error _"cannot be handled as a Pod: strict decoding error: unknown field "spec.initContainers[0].labels"

Thanks
Krishna

[patrick-stephens]

No, you can label the pod with the name of the init containers. Similar to the default-container used for kubectl logs

[iam432]

Now I got it, but I didn't understand how adding label to pod can be helpful to distinguish init container logs from regular container logs.

[patrick-stephens]

You can use that label in whatever downstream processing you want, e.g. in Grafana, in a FB filter, etc.

To distinguish things you need a way to identify them, this gives you that way.