Open source


The cri stage is a parsing stage that reads the log line using the standard CRI logging format.


  # Max buffer size to hold partial lines.
  [max_partial_lines: <int> | default = 100]

  # Max line size to hold a single partial line, if max_partial_line_size_truncate is true. Example: 262144.
  [max_partial_line_size: <int> | default = 0]

  # Allows to pretruncate partial lines before storing in partial buffer.
  [max_partial_line_size_truncate: <bool> | default = false]

Unlike most stages, the cri stage provides no configuration options and only supports the specific CRI log format. CRI specifies log lines as space-delimited values with the following components:

  1. time: The timestamp string of the log
  2. stream: Either stdout or stderr
  3. flags: CRI flags including F or P
  4. log: The contents of the log line

No whitespace is permitted between the components. In the following example, only the first log line can be properly formatted using the cri stage:

"2019-01-01T01:00:00.000000001Z stderr P test\ngood"
"2019-01-01 T01:00:00.000000001Z stderr testgood"
"2019-01-01T01:00:00.000000001Z testgood"


For the given pipeline:

- cri: {}

Given the following log line:

"2019-04-30T02:12:41.8443515Z stdout F message"

The following key-value pairs would be created in the set of extracted data:

  • content: message
  • stream: stdout
  • flags: xx
  • timestamp: 2019-04-30T02:12:41.8443515 - The cri-stage both extracts the timestamp as a label and set it as the timestamp of the log entry.