Advanced Flow examples

CoreDNS

This Flow:

• selects CoreDNS messages (every message with the k8s-app: coredns label),
• parses them, and
• sets a number of related Elastic Common Schema (ECS) fields based on the content of the message using the Record Modifier plugin.

NGINX Ingress Controller

This Flow:

• selects NGINX Ingress Controller messages (every message with the app-kubernetes-io/name: ingress-nginx label),
• parses them, and
• sets a number of related Elastic Common Schema (ECS) fields based on the content of the message using the Record Modifier plugin.
• It also adds GeoIP-related fields based on the source of the traffic using the Fluentd GeoIP filter.