Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Documentation Grafana Enterprise Logs Send data Promtail Pipeline stages cri

cri

The cri stage is a parsing stage that reads the log line using the standard CRI logging format.

Schema

yaml Copy

cri:
  # Max buffer size to hold partial lines.
  [max_partial_lines: <int> | default = 100]

  # Max line size to hold a single partial line, if max_partial_line_size_truncate is true. Example: 262144.
  [max_partial_line_size: <int> | default = 0]

  # Allows to pretruncate partial lines before storing in partial buffer.
  [max_partial_line_size_truncate: <bool> | default = false]

Unlike most stages, the cri stage provides no configuration options and only supports the specific CRI log format. CRI specifies log lines as space-delimited values with the following components:

1. time: The timestamp string of the log
2. stream: Either stdout or stderr
3. flags: CRI flags including F or P
4. log: The contents of the log line

No whitespace is permitted between the components. In the following example, only the first log line can be properly formatted using the cri stage:

Copy

"2019-01-01T01:00:00.000000001Z stderr P test\ngood"
"2019-01-01 T01:00:00.000000001Z stderr testgood"
"2019-01-01T01:00:00.000000001Z testgood"

Examples

For the given pipeline:

yaml Copy

- cri: {}

Given the following log line:

Copy

"2019-04-30T02:12:41.8443515Z stdout F message"

The following key-value pairs would be created in the set of extracted data:

• content: message
• stream: stdout
• flags: F
• timestamp: 2019-04-30T02:12:41.8443515 - The cri-stage both extracts the timestamp as a label and set it as the timestamp of the log entry.