fluent.conf

<source>
  type tail
  path /var/log/containers/*.log
  pos_file /var/log/es-containers.log.pos
  time_format %Y-%m-%dT%H:%M:%S
  tag kubernetes.*
  format json
  read_from_head true
</source>

<filter kubernetes.**>
  type kubernetes_metadata
</filter>

<filter kubernetes.**>
  type record_transformer
  renew_record true
  enable_ruby true
  keep_keys facility,stream
  <record>
    host ${Socket.gethostname}
    version "1.1"
    short_message ${log}
    _docker_container_id ${docker[:container_id]}
    _kubernetes_namespace ${kubernetes[:namespace_name]}
    _kubernetes_pod ${kubernetes[:pod_name]}
    _kubernetes_container ${kubernetes[:container_name]}
  </record>
</filter>


<match kubernetes.**>
   type copy
   <store>
     type gelf
     input_encoding 'iso-8859-1'
     host "#{ENV['GELF_HOST']}"
     port "#{ENV['GELF_PORT']}"
     flush_interval 5s
   </store>
</match>