You can use custom key-value pairs with Kubernetes data to label logs, which makes them easier to search. Sumo Logic Kubernetes apps allow you to add fields that define key-value pairs at the source level. Customized key value pairs in metadata streams are automatically extracted for searching, querying, and graphing. This allows you to view results for subsets that are not traditionally tagged as source categories. For example, there may be times when you want to expose custom pod labels or namespace labels in your data.
Using fields to create custom key-value pairs
Kubernetes is rich with metadata, and custom key-value pairs allow you to search more intuitively. You can search by containers, pods, and investigate namespaces. Metadata that includes key value pairs will enable you to quickly find what you need in your log data.
The following task shows you how to create a key-value pair that exposes a pod label, using the following syntax: pod_label_<Label_Name>.
To create a custom key value pair, do the following:
- From the main Sumo Logic page, select Manage Data > Collection in the left menu bar.
- Click Collection at the top left of the window to view a list of available data collectors.
- Select the collector to which you want to add a field with a custom key-value pair. In our example, we selected the Falco collector.
The Edit Collector dialog appears.
- Click Add Field.
- Enter a Field Name and Value in the respective text fields. In our example we created a pod label field (pod_label<Label_Name>) so we could search for testing pod log data.
- Click Save.