Kiam logs break fluentbit

[pierluigilenoci]

If I try to use json logs for kiam on my k8s cluster I get this error from fluent-bit:

{"type":"mapper_parsing_exception","reason":"failed to parse","caused_by":{"type":"json_parse_exception","reason":"Duplicate field 'time'\n

This happens because kiam produce a log like this:

{"level":"info","msg":"found role","pod.iam.role":"arn:aws:iam::xxxxx:role/xxxx","pod.ip":"xxx.xxx.xxx.xxx","time":"2019-11-06T13:20:13Z"}

The field time is a reserved key for the docker log. When docker tries to merge the kiam log with the container log produce a not valid JSON.

Could you add a way to change kiam to use another field name? Or at least a way to configure the JSON log to use different field names.

[pierluigilenoci]

Also ref: fluent/fluent-bit#1051

[pierluigilenoci]

Moreover, it is not necessary to add the time field to the log as it is added automatically by docker directly. It does not add any information

[pingles]

I believe these fields are added automatically by the logging library.

Having said that, it looks like it's possible to customise the the time key so potentially that could be added as a flag (with a default value that matches the current behaviour).

https://github.com/sirupsen/logrus/blob/master/json_formatter.go#L38 if someone wants to pick it up. It looks like the field can be removed altogether also https://github.com/sirupsen/logrus/blob/master/json_formatter.go#L29.

I'm not against flags to provide this as long as they're nicely named and preserve existing behaviour by default to avoid subtly breaking things for cluster operators.

[pierluigilenoci]

@pingles any news?