Skip to content

v1.adoc

Latest commit

 

History

History
2748 lines (1917 loc) · 98 KB

v1.adoc

File metadata and controls

2748 lines (1917 loc) · 98 KB
Raw

Logging Data Model Reference

Package viaq/v1

Viaq Data Model for kubernetes api events

The data model for collected audit event logs from kubernetes or OpenShift api servers.

nolint:govet

Property Type Description

involvedObject

object

The object that this event is about.

reason

string

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

message

string

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

source

object

(optional) The component reporting this event. Should be a short machine understandable string.

firstTimestamp

string

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

lastTimestamp

string

(optional) The time at which the most recent occurrence of this event was recorded.

count

int

(optional) The number of times this event has occurred.

type

string

(optional) Type of this event (Normal, Warning), new types could be added in the future

eventTime

object

(optional) Time when this Event was first observed.

series

object

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

action

string

(optional) What action was taken/failed regarding to the Regarding object.

related

object

(optional) Optional secondary object for more complex actions.

reportingComponent

string

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

reportingInstance

string

(optional) ID of the controller instance, e.g. kubelet-xyzf.

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

openshift

object

Openshift specific metadata
Property Type Description

action

string

(optional) What action was taken/failed regarding to the Regarding object.

count

int

(optional) The number of times this event has occurred.

eventTime

object

(optional) Time when this Event was first observed.

firstTimestamp

string

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

involvedObject

object

The object that this event is about.

lastTimestamp

string

(optional) The time at which the most recent occurrence of this event was recorded.

message

string

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

reason

string

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

related

object

(optional) Optional secondary object for more complex actions.

reportingComponent

string

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

reportingInstance

string

(optional) ID of the controller instance, e.g. kubelet-xyzf.

series

object

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

source

object

(optional) The component reporting this event. Should be a short machine understandable string.

type

string

(optional) Type of this event (Normal, Warning), new types could be added in the future

.action

(optional) What action was taken/failed regarding to the Regarding object.

Type

string

.count

(optional) The number of times this event has occurred.

Type

int

.eventTime

(optional) Time when this Event was first observed.

Type

object

Property Type Description

Time

string

.eventTime.Time

Type

string

.firstTimestamp

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

Type

string

.involvedObject

The object that this event is about.

Type

object

Property Type Description

apiVersion

string

(optional) API version of the referent.

fieldPath

string

(optional) If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.

kind

string

name

string

namespace

string

resourceVersion

string

(optional) Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

uid

string

.involvedObject.apiVersion

(optional) API version of the referent.

Type

string

.involvedObject.fieldPath

(optional) If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.

Type

string

.involvedObject.kind

Type

string

.involvedObject.name

Type

string

.involvedObject.namespace

Type

string

.involvedObject.resourceVersion

(optional) Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

Type

string

.involvedObject.uid

Type

string

.lastTimestamp

(optional) The time at which the most recent occurrence of this event was recorded.

Type

string

.message

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

Type

string

.reason

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

Type

string

.related

(optional) Optional secondary object for more complex actions.

Type

object

.reportingComponent

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

Type

string

.reportingInstance

(optional) ID of the controller instance, e.g. kubelet-xyzf.

Type

string

.series

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

Type

object

.source

(optional) The component reporting this event. Should be a short machine understandable string.

Type

object

Property Type Description

component

string

(optional) Component from which the event is generated.

host

string

(optional) Node name on which the event is generated.

.source.component

(optional) Component from which the event is generated.

Type

string

.source.host

(optional) Node name on which the event is generated.

Type

string

.type

(optional) Type of this event (Normal, Warning), new types could be added in the future

Type

string

Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

.@timestamp

A UTC value that marks when the log payload was created.

If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.hostname

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

Type

string

.level

The normalized log level

The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others.

The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages.

The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize.

Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

Type

string

.log_source

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

Type

string

.log_type

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

      Type

      string

.message

(optional) Original log entry text, UTF-8 encoded

This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

Type

string

.openshift

Openshift specific metadata

Type

object

Property Type Description

cluster_id

string

ClusterID is the unique id of the cluster where the workload is deployed

labels

object

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

sequence

string

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

.openshift.cluster_id

ClusterID is the unique id of the cluster where the workload is deployed

Type

string

.openshift.labels

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

Type

object

.openshift.sequence

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

Type

string

.pipeline_metadata

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

Type

object

Property Type Description

collector

object

Collector metadata

.pipeline_metadata.collector

Collector metadata

Type

object

Property Type Description

inputname

string

(DEPRECATED)

ipaddr4

string

(optional) Ipaddr4 is the ipV4 address of the collector

name

string

Name is the implementation of the collector agent

original_raw_message

string

OriginalRawMessage captures the original message for eventrouter logs

received_at

string

ReceivedAt the time the collector received the log entry

version

string

Version is collector version information

.pipeline_metadata.collector.inputname

(DEPRECATED)

Type

string

.pipeline_metadata.collector.ipaddr4

(optional) Ipaddr4 is the ipV4 address of the collector

Type

string

.pipeline_metadata.collector.name

Name is the implementation of the collector agent

Type

string

.pipeline_metadata.collector.original_raw_message

OriginalRawMessage captures the original message for eventrouter logs

Type

string

.pipeline_metadata.collector.received_at

ReceivedAt the time the collector received the log entry

Type

string

.pipeline_metadata.collector.version

Version is collector version information

Type

string

.timestamp

A UTC value that marks when the log payload was created.

Value derived from legacy @timestamp for forward compatibility.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.viaq_index_name

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).

Type

string

.viaq_msg_id

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified.

It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record.

This is only present when deploying fluentd collector implementations

Type

string

Viaq Data Model for Containers

The data model for collected logs from containers.

Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

docker

object

(DEPRECATED) (optional)

kubernetes

object

The Kubernetes-specific metadata

structured

object

(optional) Original log entry as a structured object. Example: {"pid":21631,"ppid":21618,"worker":0,"message":"starting fluentd worker pid=21631 ppid=21618 worker=0"} This field may be present if the forwarder was configured to parse structured JSON logs. If the original log entry was a valid structured log, this field will contain an equivalent JSON structure. Otherwise this field will be empty or absent, and the message field will contain the original log message. The structured field includes the same sub-fields as the original log message.
Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

.@timestamp

A UTC value that marks when the log payload was created.

If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.hostname

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

Type

string

.level

The normalized log level

The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others.

The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages.

The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize.

Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

Type

string

.log_source

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

Type

string

.log_type

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

      Type

      string

.message

(optional) Original log entry text, UTF-8 encoded

This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

Type

string

.openshift

Openshift specific metadata

Type

object

Property Type Description

cluster_id

string

ClusterID is the unique id of the cluster where the workload is deployed

labels

object

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

sequence

string

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

.openshift.cluster_id

ClusterID is the unique id of the cluster where the workload is deployed

Type

string

.openshift.labels

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

Type

object

.openshift.sequence

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

Type

string

.pipeline_metadata

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

Type

object

Property Type Description

collector

object

Collector metadata

.pipeline_metadata.collector

Collector metadata

Type

object

Property Type Description

inputname

string

(DEPRECATED)

ipaddr4

string

(optional) Ipaddr4 is the ipV4 address of the collector

name

string

Name is the implementation of the collector agent

original_raw_message

string

OriginalRawMessage captures the original message for eventrouter logs

received_at

string

ReceivedAt the time the collector received the log entry

version

string

Version is collector version information

.pipeline_metadata.collector.inputname

(DEPRECATED)

Type

string

.pipeline_metadata.collector.ipaddr4

(optional) Ipaddr4 is the ipV4 address of the collector

Type

string

.pipeline_metadata.collector.name

Name is the implementation of the collector agent

Type

string

.pipeline_metadata.collector.original_raw_message

OriginalRawMessage captures the original message for eventrouter logs

Type

string

.pipeline_metadata.collector.received_at

ReceivedAt the time the collector received the log entry

Type

string

.pipeline_metadata.collector.version

Version is collector version information

Type

string

.timestamp

A UTC value that marks when the log payload was created.

Value derived from legacy @timestamp for forward compatibility.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.viaq_index_name

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).

Type

string

.viaq_msg_id

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified.

It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record.

This is only present when deploying fluentd collector implementations

Type

string

.docker

(DEPRECATED) (optional)

Type

object

Property Type Description

container_id

string

ContainerID is the id of the container producing the log

.docker.container_id

ContainerID is the id of the container producing the log

Type

string

.kubernetes

The Kubernetes-specific metadata

Type

object

Property Type Description

annotations

object

(optional) Annotations associated with the Kubernetes pod

container_id

string

(optional)

container_image

string

(optional)

container_image_id

string

(optional)

container_iostream

string

(optional) The name of the stream the log line was submitted to (e.g.: stdout, stderr)

container_name

string

ContainerName of the the pod container that produced the log

flat_labels

array

(DEPRECATED) (optional) FlatLabels is an array of the pod labels joined as key=value

host

string

(optional) Host is the kubernetes node name that hosts the pod

labels

object

(optional) Labels present on the Pod at time the log was generated

master_url

string

(DEPRECATED) MasterURL is the url to the apiserver

namespace_id

string

(optional) NamespaceID is the unique uuid of the namespace

namespace_labels

object

(optional) NamespaceLabels are the labels present on the pod namespace

namespace_name

string

NamespaceName where the pod is deployed

pod_id

string

(optional) PodID is the unique uuid of the pod

pod_name

string

PodName is the name of the pod

.kubernetes.annotations

(optional) Annotations associated with the Kubernetes pod

Type

object

.kubernetes.container_id

(optional)

Type

string

.kubernetes.container_image

(optional)

Type

string

.kubernetes.container_image_id

(optional)

Type

string

.kubernetes.container_iostream

(optional) The name of the stream the log line was submitted to (e.g.: stdout, stderr)

Type

string

.kubernetes.container_name

ContainerName of the the pod container that produced the log

Type

string

.kubernetes.flat_labels[]

(DEPRECATED) (optional) FlatLabels is an array of the pod labels joined as key=value

Type

array

.kubernetes.host

(optional) Host is the kubernetes node name that hosts the pod

Type

string

.kubernetes.labels

(optional) Labels present on the Pod at time the log was generated

Type

object

.kubernetes.master_url

(DEPRECATED) MasterURL is the url to the apiserver

Type

string

.kubernetes.namespace_id

(optional) NamespaceID is the unique uuid of the namespace

Type

string

.kubernetes.namespace_labels

(optional) NamespaceLabels are the labels present on the pod namespace

Type

object

.kubernetes.namespace_name

NamespaceName where the pod is deployed

Type

string

.kubernetes.pod_id

(optional) PodID is the unique uuid of the pod

Type

string

.kubernetes.pod_name

PodName is the name of the pod

Type

string

.structured

(optional) Original log entry as a structured object.

Example: {"pid":21631,"ppid":21618,"worker":0,"message":"starting fluentd worker pid=21631 ppid=21618 worker=0"}

This field may be present if the forwarder was configured to parse structured JSON logs. If the original log entry was a valid structured log, this field will contain an equivalent JSON structure. Otherwise this field will be empty or absent, and the message field will contain the original log message. The structured field includes the same sub-fields as the original log message.

Type

object

Viaq Data Model for EventRouter

The data model for event logs collected from the EventRouter.

Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

kubernetes

object

The Kubernetes-specific metadata

old_event

object

OldEvent is a core KubernetesEvent that was replaced by kubernetes.event
Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

.@timestamp

A UTC value that marks when the log payload was created.

If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.hostname

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

Type

string

.level

The normalized log level

The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others.

The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages.

The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize.

Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

Type

string

.log_source

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

Type

string

.log_type

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

      Type

      string

.message

(optional) Original log entry text, UTF-8 encoded

This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

Type

string

.openshift

Openshift specific metadata

Type

object

Property Type Description

cluster_id

string

ClusterID is the unique id of the cluster where the workload is deployed

labels

object

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

sequence

string

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

.openshift.cluster_id

ClusterID is the unique id of the cluster where the workload is deployed

Type

string

.openshift.labels

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

Type

object

.openshift.sequence

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

Type

string

.pipeline_metadata

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

Type

object

Property Type Description

collector

object

Collector metadata

.pipeline_metadata.collector

Collector metadata

Type

object

Property Type Description

inputname

string

(DEPRECATED)

ipaddr4

string

(optional) Ipaddr4 is the ipV4 address of the collector

name

string

Name is the implementation of the collector agent

original_raw_message

string

OriginalRawMessage captures the original message for eventrouter logs

received_at

string

ReceivedAt the time the collector received the log entry

version

string

Version is collector version information

.pipeline_metadata.collector.inputname

(DEPRECATED)

Type

string

.pipeline_metadata.collector.ipaddr4

(optional) Ipaddr4 is the ipV4 address of the collector

Type

string

.pipeline_metadata.collector.name

Name is the implementation of the collector agent

Type

string

.pipeline_metadata.collector.original_raw_message

OriginalRawMessage captures the original message for eventrouter logs

Type

string

.pipeline_metadata.collector.received_at

ReceivedAt the time the collector received the log entry

Type

string

.pipeline_metadata.collector.version

Version is collector version information

Type

string

.timestamp

A UTC value that marks when the log payload was created.

Value derived from legacy @timestamp for forward compatibility.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.viaq_index_name

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).

Type

string

.viaq_msg_id

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified.

It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record.

This is only present when deploying fluentd collector implementations

Type

string

.kubernetes

The Kubernetes-specific metadata

Type

object

Property Type Description

annotations

object

(optional) Annotations associated with the Kubernetes pod

container_id

string

(optional)

container_image

string

(optional)

container_image_id

string

(optional)

container_iostream

string

(optional) The name of the stream the log line was submitted to (e.g.: stdout, stderr)

container_name

string

ContainerName of the the pod container that produced the log

flat_labels

array

(DEPRECATED) (optional) FlatLabels is an array of the pod labels joined as key=value

host

string

(optional) Host is the kubernetes node name that hosts the pod

labels

object

(optional) Labels present on the Pod at time the log was generated

master_url

string

(DEPRECATED) MasterURL is the url to the apiserver

namespace_id

string

(optional) NamespaceID is the unique uuid of the namespace

namespace_labels

object

(optional) NamespaceLabels are the labels present on the pod namespace

namespace_name

string

NamespaceName where the pod is deployed

pod_id

string

(optional) PodID is the unique uuid of the pod

pod_name

string

PodName is the name of the pod

event

object

Event is the core KubernetesEvent
Property Type Description

annotations

object

(optional) Annotations associated with the Kubernetes pod

container_id

string

(optional)

container_image

string

(optional)

container_image_id

string

(optional)

container_iostream

string

(optional) The name of the stream the log line was submitted to (e.g.: stdout, stderr)

container_name

string

ContainerName of the the pod container that produced the log

flat_labels

array

(DEPRECATED) (optional) FlatLabels is an array of the pod labels joined as key=value

host

string

(optional) Host is the kubernetes node name that hosts the pod

labels

object

(optional) Labels present on the Pod at time the log was generated

master_url

string

(DEPRECATED) MasterURL is the url to the apiserver

namespace_id

string

(optional) NamespaceID is the unique uuid of the namespace

namespace_labels

object

(optional) NamespaceLabels are the labels present on the pod namespace

namespace_name

string

NamespaceName where the pod is deployed

pod_id

string

(optional) PodID is the unique uuid of the pod

pod_name

string

PodName is the name of the pod

.kubernetes.annotations

(optional) Annotations associated with the Kubernetes pod

Type

object

.kubernetes.container_id

(optional)

Type

string

.kubernetes.container_image

(optional)

Type

string

.kubernetes.container_image_id

(optional)

Type

string

.kubernetes.container_iostream

(optional) The name of the stream the log line was submitted to (e.g.: stdout, stderr)

Type

string

.kubernetes.container_name

ContainerName of the the pod container that produced the log

Type

string

.kubernetes.flat_labels[]

(DEPRECATED) (optional) FlatLabels is an array of the pod labels joined as key=value

Type

array

.kubernetes.host

(optional) Host is the kubernetes node name that hosts the pod

Type

string

.kubernetes.labels

(optional) Labels present on the Pod at time the log was generated

Type

object

.kubernetes.master_url

(DEPRECATED) MasterURL is the url to the apiserver

Type

string

.kubernetes.namespace_id

(optional) NamespaceID is the unique uuid of the namespace

Type

string

.kubernetes.namespace_labels

(optional) NamespaceLabels are the labels present on the pod namespace

Type

object

.kubernetes.namespace_name

NamespaceName where the pod is deployed

Type

string

.kubernetes.pod_id

(optional) PodID is the unique uuid of the pod

Type

string

.kubernetes.pod_name

PodName is the name of the pod

Type

string

.kubernetes.event

Event is the core KubernetesEvent

Type

object

Property Type Description

action

string

(optional) What action was taken/failed regarding to the Regarding object.

count

int

(optional) The number of times this event has occurred.

eventTime

object

(optional) Time when this Event was first observed.

firstTimestamp

string

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

involvedObject

object

The object that this event is about.

lastTimestamp

string

(optional) The time at which the most recent occurrence of this event was recorded.

message

string

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

reason

string

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

related

object

(optional) Optional secondary object for more complex actions.

reportingComponent

string

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

reportingInstance

string

(optional) ID of the controller instance, e.g. kubelet-xyzf.

series

object

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

source

object

(optional) The component reporting this event. Should be a short machine understandable string.

type

string

(optional) Type of this event (Normal, Warning), new types could be added in the future

verb

string

Verb is indicates if event was created or updated
Property Type Description

action

string

(optional) What action was taken/failed regarding to the Regarding object.

count

int

(optional) The number of times this event has occurred.

eventTime

object

(optional) Time when this Event was first observed.

firstTimestamp

string

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

involvedObject

object

The object that this event is about.

lastTimestamp

string

(optional) The time at which the most recent occurrence of this event was recorded.

message

string

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

reason

string

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

related

object

(optional) Optional secondary object for more complex actions.

reportingComponent

string

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

reportingInstance

string

(optional) ID of the controller instance, e.g. kubelet-xyzf.

series

object

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

source

object

(optional) The component reporting this event. Should be a short machine understandable string.

type

string

(optional) Type of this event (Normal, Warning), new types could be added in the future

.kubernetes.event.action

(optional) What action was taken/failed regarding to the Regarding object.

Type

string

.kubernetes.event.count

(optional) The number of times this event has occurred.

Type

int

.kubernetes.event.eventTime

(optional) Time when this Event was first observed.

Type

object

Property Type Description

Time

string

.kubernetes.event.eventTime.Time

Type

string

.kubernetes.event.firstTimestamp

(optional) The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)

Type

string

.kubernetes.event.involvedObject

The object that this event is about.

Type

object

Property Type Description

apiVersion

string

(optional) API version of the referent.

fieldPath

string

(optional) If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.

kind

string

name

string

namespace

string

resourceVersion

string

(optional) Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

uid

string

.kubernetes.event.involvedObject.apiVersion

(optional) API version of the referent.

Type

string

.kubernetes.event.involvedObject.fieldPath

(optional) If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.

Type

string

.kubernetes.event.involvedObject.kind

Type

string

.kubernetes.event.involvedObject.name

Type

string

.kubernetes.event.involvedObject.namespace

Type

string

.kubernetes.event.involvedObject.resourceVersion

(optional) Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

Type

string

.kubernetes.event.involvedObject.uid

Type

string

.kubernetes.event.lastTimestamp

(optional) The time at which the most recent occurrence of this event was recorded.

Type

string

.kubernetes.event.message

(optional) A human-readable description of the status of this operation. TODO: decide on maximum length.

Type

string

.kubernetes.event.reason

(optional) This should be a short, machine understandable string that gives the reason for the transition into the object's current status. TODO: provide exact specification for format.

Type

string

.kubernetes.event.related

(optional) Optional secondary object for more complex actions.

Type

object

.kubernetes.event.reportingComponent

(optional) Name of the controller that emitted this Event, e.g. kubernetes.io/kubelet.

Type

string

.kubernetes.event.reportingInstance

(optional) ID of the controller instance, e.g. kubelet-xyzf.

Type

string

.kubernetes.event.series

(optional) Data about the Event series this event represents or nil if it's a singleton Event.

Type

object

.kubernetes.event.source

(optional) The component reporting this event. Should be a short machine understandable string.

Type

object

Property Type Description

component

string

(optional) Component from which the event is generated.

host

string

(optional) Node name on which the event is generated.

.kubernetes.event.source.component

(optional) Component from which the event is generated.

Type

string

.kubernetes.event.source.host

(optional) Node name on which the event is generated.

Type

string

.kubernetes.event.type

(optional) Type of this event (Normal, Warning), new types could be added in the future

Type

string

.kubernetes.event.verb

Verb is indicates if event was created or updated

Type

string

.old_event

OldEvent is a core KubernetesEvent that was replaced by kubernetes.event

Type

object

Viaq Data Model for journald

The data model for collected logs from node journal.

Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

_STREAM_ID

string

_SYSTEMD_INVOCATION_ID

string

systemd

object

tag

string

time

string
Property Type Description

@timestamp

string

A UTC value that marks when the log payload was created. If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

hostname

string

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

level

string

The normalized log level The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others. The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages. The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize. Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

log_source

string

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

log_type

string

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

message

string

(optional) Original log entry text, UTF-8 encoded This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

openshift

object

Openshift specific metadata

pipeline_metadata

object

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

timestamp

string

A UTC value that marks when the log payload was created. Value derived from legacy @timestamp for forward compatibility. format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime example: 2024-11-24 T14:06:05.071000000Z

viaq_index_name

string

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write). The value depends on the log type of this message. Detailed documentation is found at https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model.

viaq_msg_id

string

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified. It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record. This is only present when deploying fluentd collector implementations

.@timestamp

A UTC value that marks when the log payload was created.

If the creation time is not known when the log payload was first collected. The “@” prefix denotes a field that is reserved for a particular use.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.hostname

The name of the host where this log message originated. In a Kubernetes cluster, this is the same as kubernetes.host.

Type

string

.level

The normalized log level

The logging level from various sources, including rsyslog(severitytext property), python's logging module, and others.

The following values come from syslog.h, and are preceded by their numeric equivalents:

  • 0 = emerg, system is unusable.

  • 1 = alert, action must be taken immediately.

  • 2 = crit, critical conditions.

  • 3 = err, error conditions.

  • 4 = warn, warning conditions.

  • 5 = notice, normal but significant condition.

  • 6 = info, informational.

  • 7 = debug, debug-level messages.

The two following values are not part of syslog.h but are widely used:

  • 8 = trace, trace-level messages, which are more verbose than debug messages.

  • 9 = unknown, when the logging system gets a value it doesn't recognize.

Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from python logging, you can match CRITICAL with crit, ERROR with err, and so on.

Type

string

.log_source

LogSource is the source of a log used along with the LogType to distinguish a subcategory of the LogType. Application logs are always sourced from containers Infrastructure logs are sourced from containers or journal logs from the node Audit logs are sourced from: kubernetes and openshift API servers, node auditd, and OVN

Type

string

.log_type

The source type of the log. The log_type field may contain one of these strings, or may have additional dot-separated components, for example "infrastructure.container" or "infrastructure.node".

  • "application": Container logs generated by user applications running in the cluster, except infrastructure containers.

  • "infrastructure": Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.

  • "audit":

    • Node logs from auditd (/var/log/audit/audit.log)

    • Kubernetes and OpenShift apiservers audit logs.

    • OVN audit logs

      Type

      string

.message

(optional) Original log entry text, UTF-8 encoded

This field may be absent or empty if a non-empty structured field is present. See the description of structured for additional details.

Type

string

.openshift

Openshift specific metadata

Type

object

Property Type Description

cluster_id

string

ClusterID is the unique id of the cluster where the workload is deployed

labels

object

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

sequence

string

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

.openshift.cluster_id

ClusterID is the unique id of the cluster where the workload is deployed

Type

string

.openshift.labels

(optional) Labels is a set of common, static labels that were spec'd for log forwarding to be sent with the log Records

Type

object

.openshift.sequence

Sequence is increasing id used in conjunction with the timestamp to establish a linear timeline of log records. This was added as a workaround for logstores that do not have nano-second precision.

Type

string

.pipeline_metadata

(DEPRECATED) (optional) Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here. Data in this subgroup is forwarded for troubleshooting and tracing purposes. This is only present when deploying fluentd collector implementations

Type

object

Property Type Description

collector

object

Collector metadata

.pipeline_metadata.collector

Collector metadata

Type

object

Property Type Description

inputname

string

(DEPRECATED)

ipaddr4

string

(optional) Ipaddr4 is the ipV4 address of the collector

name

string

Name is the implementation of the collector agent

original_raw_message

string

OriginalRawMessage captures the original message for eventrouter logs

received_at

string

ReceivedAt the time the collector received the log entry

version

string

Version is collector version information

.pipeline_metadata.collector.inputname

(DEPRECATED)

Type

string

.pipeline_metadata.collector.ipaddr4

(optional) Ipaddr4 is the ipV4 address of the collector

Type

string

.pipeline_metadata.collector.name

Name is the implementation of the collector agent

Type

string

.pipeline_metadata.collector.original_raw_message

OriginalRawMessage captures the original message for eventrouter logs

Type

string

.pipeline_metadata.collector.received_at

ReceivedAt the time the collector received the log entry

Type

string

.pipeline_metadata.collector.version

Version is collector version information

Type

string

.timestamp

A UTC value that marks when the log payload was created.

Value derived from legacy @timestamp for forward compatibility.

format:

  • yyyy-MM-dd HH:mm:ss,SSSZ

  • yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ

  • yyyy-MM-dd'T'HH:mm:ssZ

  • dateOptionalTime

example: 2024-11-24T14:06:05.071000000Z

Type

string

.viaq_index_name

(optional) ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).

Type

string

.viaq_msg_id

(optional) ViaqMessageId is a unique ID assigned to each message. The format is not specified.

It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218), or some other ASCII value and is used as the _id of the document when sending to Elasticsearch. The intended use of this field is that if you use another logging store or application other than Elasticsearch, but you still need to correlate data with the data stored in Elasticsearch, this field will give you the exact document corresponding to the record.

This is only present when deploying fluentd collector implementations

Type

string

._STREAM_ID

Type

string

._SYSTEMD_INVOCATION_ID

Type

string

.systemd

Type

object

Property Type Description

k

object

t

object

u

object

.systemd.k

Type

object

Property Type Description

KERNEL_DEVICE

string

KERNEL_SUBSYSTEM

string

UDEV_DEVLINK

string

UDEV_DEVNODE

string

UDEV_SYSNAME

string

.systemd.k.KERNEL_DEVICE

Type

string

.systemd.k.KERNEL_SUBSYSTEM

Type

string

.systemd.k.UDEV_DEVLINK

Type

string

.systemd.k.UDEV_DEVNODE

Type

string

.systemd.k.UDEV_SYSNAME

Type

string

.systemd.t

Type

object

Property Type Description

AUDIT_LOGINUID

string

AUDIT_SESSION

string

BOOT_ID

string

CAP_EFFECTIVE

string

CMDLINE

string

COMM

string

EXE

string

GID

string

HOSTNAME

string

LINE_BREAK

string

MACHINE_ID

string

PID

string

SELINUX_CONTEXT

string

STREAM_ID

string

SYSTEMD_CGROUP

string

SYSTEMD_INVOCATION_ID

string

SYSTEMD_OWNER_UID

string

SYSTEMD_SESSION

string

SYSTEMD_SLICE

string

SYSTEMD_UNIT

string

SYSTEMD_USER_UNIT

string

TRANSPORT

string

UID

string

.systemd.t.AUDIT_LOGINUID

Type

string

.systemd.t.AUDIT_SESSION

Type

string

.systemd.t.BOOT_ID

Type

string

.systemd.t.CAP_EFFECTIVE

Type

string

.systemd.t.CMDLINE

Type

string

.systemd.t.COMM

Type

string

.systemd.t.EXE

Type

string

.systemd.t.GID

Type

string

.systemd.t.HOSTNAME

Type

string

.systemd.t.LINE_BREAK

Type

string

.systemd.t.MACHINE_ID

Type

string

.systemd.t.PID

Type

string

.systemd.t.SELINUX_CONTEXT

Type

string

.systemd.t.STREAM_ID

Type

string

.systemd.t.SYSTEMD_CGROUP

Type

string

.systemd.t.SYSTEMD_INVOCATION_ID

Type

string

.systemd.t.SYSTEMD_OWNER_UID

Type

string

.systemd.t.SYSTEMD_SESSION

Type

string

.systemd.t.SYSTEMD_SLICE

Type

string

.systemd.t.SYSTEMD_UNIT

Type

string

.systemd.t.SYSTEMD_USER_UNIT

Type

string

.systemd.t.TRANSPORT

Type

string

.systemd.t.UID

Type

string

.systemd.u

Type

object

Property Type Description

CODE_FILE

string

CODE_FUNCTION

string

CODE_LINE

string

ERRNO

string

MESSAGE_ID

string

RESULT

string

SYSLOG_FACILITY

string

SYSLOG_IDENTIFIER

string

SYSLOG_PID

string

UNIT

string

.systemd.u.CODE_FILE

Type

string

.systemd.u.CODE_FUNCTION

Type

string

.systemd.u.CODE_LINE

Type

string

.systemd.u.ERRNO

Type

string

.systemd.u.MESSAGE_ID

Type

string

.systemd.u.RESULT

Type

string

.systemd.u.SYSLOG_FACILITY

Type

string

.systemd.u.SYSLOG_IDENTIFIER

Type

string

.systemd.u.SYSLOG_PID

Type

string

.systemd.u.UNIT

Type

string

.tag

Type

string

.time

Type

string