How to Disable Default Fluent Bit Parsers to Avoid Errors in Amazon CloudWatch Observability EKS Add-on?
I'm configuring Fluent Bit as part of the Amazon CloudWatch Observability EKS add-on, but I'm encountering errors related to default parsers:
[2025/02/13 13:21:48] [error] [parser] parser named 'syslog' already exists, skip.
[2025/02/13 13:21:48] [error] [input:tail:tail.3] parser 'cri' is not registered
After investigating, I found that I can disable some configurations by setting them to an empty string. For example:
observability_config = jsonencode({
"containerLogs" = {
"enabled" = true
"fluentBit" = {
"config" = {
"extraFiles" = {
"application-log.conf" = file("${path.module}/configs/some.conf"),
"dataplane-log.conf" = "",
"host-log.conf" = "",
}
}
}
}
})
I figured out that some Fluent Bit configurations can be passed using the extraFiles
key.
Here is my Fluent Bit configuration:
[SERVICE]
Flush 5
Log_Level warn
Parsers_File parsers.conf
[INPUT]
Name tail
Tag kube.*
Exclude_Path /var/log/containers/cloudwatch-agent*, /var/log/containers/fluent-bit*, /var/log/containers/aws-node*, /var/log/containers/kube-proxy*
Path /var/log/containers/*.log
Docker_Mode On
Docker_Mode_Flush 5
Docker_Mode_Parser container_firstline
Parser cri
DB /var/fluent-bit/state/flb_container.db
Mem_Buf_Limit 50MB
Skip_Long_Lines On
Refresh_Interval 10
Rotate_Wait 30
storage.type filesystem
Read_from_Head ${READ_FROM_HEAD}
[OUTPUT]
Name cloudwatch_logs
Match kube.*
region ${AWS_REGION}
log_group_name /aws/containerinsights/${CLUSTER_NAME}/application
log_stream_prefix ${HOST_NAME}-
auto_create_group true
extra_user_agent container-insights
Questions:
- How can I properly disable the default parsers to prevent these errors?
Relevant Documentation:
You can find related documentation here: