|
| 1 | +apiVersion: canaries.flanksource.com/v1 |
| 2 | +kind: Canary |
| 3 | +metadata: |
| 4 | + name: "container-log-counts" |
| 5 | + namespace: observability |
| 6 | + # The schedule can be as short or as long as you want, the query will always search for log |
| 7 | + # since the last query |
| 8 | + schedule: "@every 5m" |
| 9 | + http: |
| 10 | + - name: container_log_volume |
| 11 | + url: "http://elasticsearch.canaries.svc.cluster.local:9200/logstash-*/_search" |
| 12 | + headers: |
| 13 | + - name: Content-Type |
| 14 | + value: application/json |
| 15 | + templateBody: true |
| 16 | + test: |
| 17 | + # if no logs are found, fail the health check |
| 18 | + expr: json.?aggregations.logs.doc_count.orValue(0) > 0 |
| 19 | + # query for log counts by namespace, container and pod that have been created since the last check |
| 20 | + body: >- |
| 21 | + { |
| 22 | + "size": 0, |
| 23 | + "aggs": { |
| 24 | + "logs": { |
| 25 | + "filter": { |
| 26 | + "range": { |
| 27 | + "@timestamp" : { |
| 28 | + {{- if last_result.results.max }} |
| 29 | + "gte": "{{ last_result.results.max }}" |
| 30 | + {{- else }} |
| 31 | + "gte": "now-5m" |
| 32 | + {{- end }} |
| 33 | + } |
| 34 | + } |
| 35 | + }, |
| 36 | + "aggs": { |
| 37 | + "age": { |
| 38 | + "max": { |
| 39 | + "field": "@timestamp" |
| 40 | + } |
| 41 | + }, |
| 42 | + "labels": { |
| 43 | + "multi_terms": { |
| 44 | + "terms": [ |
| 45 | + { "field": "kubernetes_namespace_name.keyword"}, |
| 46 | + { "field": "kubernetes_container_name.keyword"}, |
| 47 | + { "field": "kubernetes_pod_name.keyword"} |
| 48 | + ], |
| 49 | + "size": 1000 |
| 50 | + } |
| 51 | + } |
| 52 | + } |
| 53 | + } |
| 54 | + } |
| 55 | + } |
| 56 | + transform: |
| 57 | + # Save the maximum age for usage in subsequent queries and create a metric for each pair |
| 58 | + expr: | |
| 59 | + json.orValue(null) != null ? |
| 60 | + [{ |
| 61 | + 'detail': { 'max': string(json.?aggregations.logs.age.value_as_string.orValue(last_result().?results.max.orValue(time.Now()))) }, |
| 62 | + 'metrics': json.?aggregations.logs.labels.buckets.orValue([]).map(k, { |
| 63 | + 'name': "namespace_log_count", |
| 64 | + 'type': "counter", |
| 65 | + 'value': double(k.doc_count), |
| 66 | + 'labels': { |
| 67 | + "namespace": k.key[0], |
| 68 | + "container": k.key[1], |
| 69 | + "pod": k.key[2] |
| 70 | + } |
| 71 | + }) |
| 72 | + }].toJSON() |
| 73 | + : '{}' |
0 commit comments