Connecting Logs and Events

As previously mentioned, Loki stores logs based on labels. This is a great way to organize your stored data so that retrieval is easier when looking for specific log entries. In this Pipeline, you'll configure an Eval Function to add the labels to the __labels field.

tip

By default, no labels are defined for the Loki Destination. Because Loki requires at least one label, Cribl will automatically add a default label source with the value cribl_${__inputId}.

Let's walk through setting up this simple Pipeline.

important

1. On the Collect tab, hover over the blue plus button on the right side of the Kubernetes Logs Source.
2. Click the blue plus button. While holding down the mouse button, drag the connector to the Loki Destination and then release.
3. In the Connection Configuration dialog, select Pipeline.
4. The Add Pipeline to Connection dialog will appear.
5. Click the Add Pipeline button.
6. Click the Create Pipeline option from the drop-down list.
7. Enter kube_logs_loki_labels in the ID field.
8. Click Save.
9. Click Add Function and select Eval Function from the Standard section.
10. Add the following config to the Evaluate Fields section:

Name	Value Expression
__labels	{}
__labels.namespace	kube_namespace
__labels.pod	kube_pod
__labels.container	kube_container

1. Click Save.
2. Click the X in the top right corner to close the Pipeline editor.
3. Select the Pipeline by clicking the radio button to the left of the kube_logs_loki_labels ID.
4. Click Save.

You should now have a QuickConnect Route attached between the Kubernetes Logs Source and the Loki Destination with a Pipeline icon on the connection.

Connect the Kubernetes Events Source

You'll now configure the Kubernetes Events Source to forward data to the Loki instance.

important

1. On the Collect tab, hover over the blue plus button on the right side of the Kubernetes Events Source.
2. Click the blue plus button. While holding down the mouse button, drag the connector to the Loki Destination and then release.
3. In the Connection Configuration dialog, click Save to accept the default Passthru connection setting.

That's it for logs and events! Now let's configure the metrics sources. Let's goat!