promtail - 事件路由器事件的 Promtail 正则表达式问题

Question

我在 k8s 中使用 eventrouter，并使用 Promtail 将日志收集到 Loki。日志格式如下：

I0803 11:37:11.317223       1 glogsink.go:42] {"verb":"ADDED","event":{"metadata":{"name":"my-release-postgresql-0.1697c8da8d306360","namespace":"default","uid":"5aa6e94b-047e-4e81-86b6-0d276bc73fea","resourceVersion":"4599","creationTimestamp":"2021-08-03T11:37:11Z","managedFields":[{"manager":"kubelet","operation":"Update","apiVersion":"v1","time":"2021-08-03T11:37:11Z"}]},"involvedObject":{"kind":"Pod","namespace":"default","name":"my-release-postgresql-0","uid":"6874d790-2da8-438b-a315-591616052d72","apiVersion":"v1","resourceVersion":"4592","fieldPath":"spec.containers{my-release-postgresql}"},"reason":"Created","message":"Created container my-release-postgresql","source":{"component":"kubelet","host":"minikube"},"firstTimestamp":"2021-08-03T11:37:11Z","lastTimestamp":"2021-08-03T11:37:11Z","count":1,"type":"Normal","eventTime":null,"reportingComponent":"","reportingInstance":""}}

我正在尝试使用正则表达式获取 Json 部分，然后解析为 json。现在我的yaml是：

 pipelineStages:
      - match:
          selector: '{name="eventrouter"}'
          stages:
          - regex:
              expression: ^.*] (?P<data>{.*),"(?P<data2>firstTimestamp.*)}}$

但是没有名为“数据”的新字段有人可以帮忙吗？

标签： promtail