Rancher 2.1.6-rc3
I configured at PROJECT level logging using syslog to send logs to logstach and in the end to elastic.
The expected behaviour is getting a log event with all kubernetes metadata (labels, time, namespace etc.) plus the log occurred in the STDOUT of the container in the POD.
Instead I get 2 log events: one with the kubernetes metadata another with the proper LOG message (in this case a NGINX just to testing easy things).
Is this the proper behaviour and it’s me that do not know syslog enough or there is a bug?
I’d like to parse the log fileds with logstash applying different parsing based on metadata information, but having the two separated in 2 different log events makes this impossible