With the below configmap I was trying to parse any json if present in the body, it is giving me regex parsing error, not sure why

- id: parser-nucash-regex
          parse_from: body
          regex: ^"(?P<nucash_json>{.*})\\n"
          type: regex_parser
        - id: parser-nucash-json
          parse_from: attributes.nucash_json
          type: json_parser

@Apoorva you don’t need to use a regex parser. This is what I understand. • Your applications emit logs in JSON format something like this.

{
  "component": "aaa",
  "env": "dev",
  "file": "/go/src/bitbucket.org/nucashin/sample/main.go:73",
  "func": "main.main",
  "level": "info",
  "msg": "Something",
  "service": "aaa",
  "time": "2022-10-24T09:49:29Z"
}

• Now you want these keys/fields to be parsed so that you can filter them on the UI. For this, you can directly use the JSON parser and add the following operator towards the end of your config file

- id: parser-nucash-json
        parse_from: body
        type: json_parser

This will convert all the keys to fields. If you don’t want some of these keys to be present as fields you can use the remove operator

I would also recommend you to setup a new receiver for this namespace as you are modifying the parsing rules for specifiec namespace. for this you can create a new filelog receiver with and configure it only for that namespace where you can copy the config of normal k8s receiver and add your logic.

filelog/services:
          include:
            # Include logs from all container in services namespace
            - /var/log/pods/services/*/*.log

If you decide going with this approach, do disable this namespace from the normal k8s log receiver.

filelog/k8s:
          include:
            # Include logs from all container
            - /var/log/pods/*/*/*.log
          exclude:
            # exclude services logs
            - /var/log/pods/services/*/*.log
            # Exclude logs from all containers from kube-system namespace
            - /var/log/pods/kube-system_*/*/*.log
            # Exclude logs from all hotrod containers
            - /var/log/pods/*_hotrod-*/*/*.log
            - /var/log/pods/*_locust-*_*/*/*.log