mode: daemonset

image:
  repository: otel/opentelemetry-collector-contrib
command:
  name: "otelcol-contrib"

presets:
  kubernetesAttributes:
    enabled: true
    extractAllPodLabels: true
  kubernetesEvents:
    enabled: true

extraVolumes:
  - name: varlog
    hostPath:
      path: /var/log

extraVolumeMounts:
  - name: varlog
    mountPath: /var/log
    readOnly: true

config:
  receivers:
    otlp:
      protocols:
        grpc:
          endpoint: 0.0.0.0:4317
        http:
          endpoint: 0.0.0.0:4318
    filelog:
      include:
        - /var/log/pods/*/*/*.log
      exclude:
        - /var/log/pods/*/otel-collector/*.log
      start_at: beginning
      include_file_path: true
      include_file_name: false
      operators:
        # Format is used by kubernetes
        - type: router
          id: get-format
          routes:
            - output: parser-docker
              expr: 'body matches "^\\{"'
            - output: parser-crio
              expr: 'body matches "^[^ Z]+ "'
            - output: parser-containerd
              expr: 'body matches "^[^ Z]+Z"'
        # Parse CRI-O format
        - type: regex_parser
          id: parser-crio
          regex: "^(?P<time>[^ Z]+) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*)?(?P<log>.*)$"
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout_type: gotime
            layout: "2006-01-02T15:04:05.999999999Z07:00"
        # Parse CRI-Containerd format
        - type: regex_parser
          id: parser-containerd
          regex: "^(?P<time>[^ ^Z]+Z) (?P<stream>stdout|stderr) (?P<logtag>[^ ]*)?(?P<log>.*)$"
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout: "%Y-%m-%dT%H:%M:%S.%LZ"
        # Parse Docker format
        - type: json_parser
          id: parser-docker
          output: extract_metadata_from_filepath
          timestamp:
            parse_from: attributes.time
            layout: "%Y-%m-%dT%H:%M:%S.%LZ"
        - type: move
          from: attributes.log
          to: body
        # Extract metadata from file path
        - type: regex_parser
          id: extract_metadata_from_filepath
          # Pod UID is not always 36 characters long
          regex: '^.*\/(?P<namespace>[^_]+)_(?P<pod_name>[^_]+)_(?P<uid>[a-f0-9\-]{16,36})\/(?P<container_name>[^\._]+)\/(?P<restart_count>\d+)\.log$'
          parse_from: attributes["log.file.path"]
          cache:
            size: 128 # default maximum amount of Pods per Node is 110
        # Rename attributes
        - type: move
          from: attributes["log.file.path"]
          to: resource["filename"]
        - type: move
          from: attributes.container_name
          to: resource["container"]
        - type: move
          from: attributes.namespace
          to: resource["namespace"]
        - type: move
          from: attributes.pod_name
          to: resource["pod"]

  processors:
    resource:
      attributes:
        - action: insert
          key: loki.format
          value: raw
        - action: insert
          key: loki.resource.labels
          value: pod, namespace, container, cluster, filename
    memory_limiter:
      check_interval: 1s
      limit_percentage: 75
      spike_limit_percentage: 15
    batch:
      send_batch_size: 10000
      timeout: 10s
    resourcedetection:
      detectors: ["env", "system"]
      override: false
    attributes:
      actions:
        - action: insert
          key: loki.attribute.labels
          value: event.domain, event.name
        - action: insert
          key: timestamp
          value: $CURRENT_TIME
        - action: insert
          key: loki.resource.labels
          value: service.name, service.namespace
        - action: insert
          key: traceID
          value: trace.id
    transform/drop_unneeded_resource_attributes:
      error_mode: ignore
      trace_statements:
        - context: resource
          statements:
            - delete_key(attributes, "k8s.pod.start_time")
            - delete_key(attributes, "os.description")
            - delete_key(attributes, "os.type")
            - delete_key(attributes, "process.command_args")
            - delete_key(attributes, "process.executable.path")
            - delete_key(attributes, "process.pid")
            - delete_key(attributes, "process.runtime.description")
            - delete_key(attributes, "process.runtime.name")
            - delete_key(attributes, "process.runtime.version")
      log_statements:
        - context: resource
          statements:
            - delete_key(attributes, "k8s.pod.start_time")
            - delete_key(attributes, "os.description")
            - delete_key(attributes, "os.type")
            - delete_key(attributes, "process.command_args")
            - delete_key(attributes, "process.executable.path")
            - delete_key(attributes, "process.pid")
            - delete_key(attributes, "process.runtime.description")
            - delete_key(attributes, "process.runtime.name")
            - delete_key(attributes, "process.runtime.version")

  exporters:
    debug:
      verbosity: detailed
    otlp:
      endpoint: tempo.monitoring.svc:4317
      tls:
        insecure: true
    loki:
      endpoint: http://loki-gateway.monitoring.svc/loki/api/v1/push
      tls:
        insecure: true
  service:
    extensions:
      - health_check
    pipelines:
      metrics:
        receivers: [otlp]
        processors: []
        exporters: [debug]
      traces:
        receivers: [otlp]
        processors:
          [
            memory_limiter,
            resourcedetection,
            transform/drop_unneeded_resource_attributes,
            attributes,
            batch,
          ]
        exporters: [debug, otlp]
      logs:
        receivers: [filelog]
        processors:
          [
            resource,
            memory_limiter,
            resourcedetection,
            transform/drop_unneeded_resource_attributes,
            attributes,
            batch,
          ]
        exporters: [loki]

service:
  enabled: true

resources:
  limits:
    cpu: 1
    memory: 2Gi