Stream Kubernetes logs with Fluent Bit (Logs Classic)

openShift:
  enabled: false

securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true

rbac:
  nodeAccess: true

config:
  inputs: |

    [INPUT]
        Name tail
        Tag kube.*
        Path /var/log/containers/*.log
        DB /fluent-bit/tail/kube.db
        DB.Sync Normal
        multiline.parser cri
        Mem_Buf_Limit 15MB
        Skip_Long_Lines On

  filters: |

    [FILTER]
        Name kubernetes
        Match kube.*
        Merge_Log On
        Keep_Log Off
        K8S-Logging.Parser Off
        K8S-Logging.Exclude Off
        Labels Off
        Annotations On
        Use_Kubelet On
        Kubelet_Host ${NODE_IP}
        tls.verify Off
        Buffer_Size 0

    # Only include logs from pods with the annotation
    #[FILTER]
    #    Name grep
    #    Match kube.*
    #    Regex $kubernetes['annotations']['logs.dynatrace.com/ingest'] ^true$

    # Only include logs from specific namespaces, remove the whole filter section to get all logs
    #[FILTER]
    #    Name grep
    #    Match kube.*
    #    Logical_Op or
    #    Regex $kubernetes['namespace_name'] ^my-namespace-a$
    #    Regex $kubernetes['namespace_name'] ^my-namespace-b$

    [FILTER]
        Name nest
        Match kube.*
        Operation lift
        Nested_under kubernetes
        Add_prefix kubernetes.

    [FILTER]
        name nest
        match kube.*
        operation lift
        nested_under kubernetes.annotations
        add_prefix kubernetes.annotations.

    [FILTER]
        Name nest
        Match kube.*
        Operation nest
        Nest_under dt.metadata
        Wildcard kubernetes.annotations.metadata.dynatrace.com/*

    [FILTER]
        Name nest
        Match kube.*
        Operation lift
        Nested_under dt.metadata
        Remove_prefix kubernetes.annotations.metadata.dynatrace.com/

    [FILTER]
        Name modify
        Match kube.*

        # Map data to Dynatrace log format
        Rename time timestamp
        Rename log content

        Rename kubernetes.host k8s.node.name
        Rename kubernetes.namespace_name k8s.namespace.name
        Rename kubernetes.pod_id k8s.pod.uid
        Rename kubernetes.pod_name k8s.pod.name
        Rename kubernetes.container_name k8s.container.name

        Add k8s.cluster.name ${K8S_CLUSTER_NAME}
        Add k8s.cluster.uid ${K8S_CLUSTER_UID}

        # deprecated, but still in use
        Add dt.kubernetes.cluster.name ${K8S_CLUSTER_NAME}
        Add dt.kubernetes.cluster.id ${K8S_CLUSTER_UID}

        Remove_wildcard kubernetes.

  outputs: |

    # Send data to Dynatrace log ingest API
    [OUTPUT]
        Name http
        Match kube.*
        host ${DT_INGEST_HOST}
        port 443
        tls On
        tls.verify On
        uri /api/v2/logs/ingest
        format json_stream
        allow_duplicated_headers false
        header Authorization Api-Token ${DT_INGEST_TOKEN}
        header Content-Type application/json; charset=utf-8
        json_date_key timestamp
        json_date_format iso8601
        log_response_payload false

daemonSetVolumes:
  - hostPath:
      path: /var/lib/fluent-bit/
    name: positions
  - hostPath:
      path: /var/log/containers
    name: containers
  - hostPath:
      path: /var/log/pods
    name: pods

daemonSetVolumeMounts:
  - mountPath: /fluent-bit/tail
    name: positions
  - mountPath: /var/log/containers
    name: containers
    readOnly: true
  - mountPath: /var/log/pods
    name: pods
    readOnly: true

podAnnotations:
  dynatrace.com/inject: "false"
#  Uncomment this to collect Fluent Bit Prometheus metrics
#  metrics.dynatrace.com/path: "/api/v1/metrics/prometheus"
#  metrics.dynatrace.com/port: "2020"
#  metrics.dynatrace.com/scrape: "true"

envWithTpl:
  - name: K8S_CLUSTER_UID
    value: '{{ (lookup "v1" "Namespace" "" "kube-system").metadata.uid }}'

env:
  - name: K8S_CLUSTER_NAME
    value: "{ENTER_YOUR_CLUSTER_NAME}"
  - name: DT_INGEST_HOST
    value: "{your-environment-id}.live.dynatrace.com"
  - name: DT_INGEST_TOKEN
    value: "{ENTER_YOUR_INGEST_TOKEN}"
  - name: NODE_IP
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: status.hostIP