change the filter query

[steveny91]

What does this PR do?

container short image name that is automatically assigned as the source.

[steveny91]

Staging screenshots:

[nhinsch]

Hi @steveny91, unfortunately I don't think we can support changing the source filter query for this integration as it is already used in production. This would be a breaking change that would cause all logs sent with the current source to suddenly no longer be parsed by the pipeline.

Can you elaborate a bit more on the goal you are trying to achieve here, etc.?

[steveny91]

@nhinsch So the problem is this. When I first made this pipeline, I had manually set the source on my pod to collect the logs with source:argo_rollouts, because I was using a demo image that was called argo-demo. But recently I was testing it out with the official argo rollouts image, the short image name there is argo-rollouts. In kubernetes when collecting logs with container_collect_all, we automatically tag the logs source from each pod based on their short_image name. In the normal case it will be source:argo-rollouts.

I wanted to change the source here because I think a large majority of our customers can just collect logs from their argo rollouts instances without needing to manually configure the log source in a containerzied environment (which it's almost exclusively kubernetes based).

My other approach was to add in a OR source:argo-rollouts to the filter, but it didn't pass the validations. Any good ways to work around this? This is more of a QoL type of change.

Thanks for looking into this!

[nhinsch]

For the second source, did you use the syntax source:(thing OR other_thing)?
I think adding a second source would be a better way to go here.

[steveny91]

@nhinsch I did that here with failing validations:
58f40d6

I gave your syntax a try and the validations have the same failure.

[steveny91]

@nhinsch Friendly bump on this to see if you have any suggestions here. 🙇

[steveny91]

@nhinsch Just wanted to give this a bump again. Feel free to contact me over slack if it's easier/