fluent-plugin-kubernetes_sumologic 0.0.1

data/Rakefile

@@ -0,0 +1,11 @@
+require 'bundler/gem_tasks'
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+  test.warning = false
+end
+
+task :default => :test

data/ci/build.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+echo "Starting build process in: `pwd`"
+set -e
+
+VERSION="${TRAVIS_TAG:-0.0.0}"
+: "${DOCKER_TAG:=sumologic/fluentd-kubernetes-sumologic}"
+: "${DOCKER_USERNAME:=sumodocker}"
+PLUGIN_NAME="fluent-plugin-kubernetes_sumologic"
+
+echo "Building for tag $VERSION, modify .gemspec file..."
+sed -i.bak "s/0.0.0/$VERSION/g" ./$PLUGIN_NAME.gemspec
+rm -f ./$PLUGIN_NAME.gemspec.bak
+
+echo "Install bundler..."
+bundle install
+
+echo "Run unit tests..."
+bundle exec rake
+
+echo "Build gem $PLUGIN_NAME $VERSION..."
+gem build $PLUGIN_NAME
+
+echo "Building docker image with $DOCKER_TAG:$VERSION and $DOCKER_TAG:latest in `pwd`..."
+docker build . -f ./Dockerfile -t $DOCKER_TAG:$VERSION --no-cache
+docker build . -f ./Dockerfile -t $DOCKER_TAG:latest
+
+if [[ -z "${DOCKER_PASSWORD}" ]] || [[ -z "${TRAVIS_TAG}" ]]; then
+    echo "Skip Docker pushing"
+else
+    echo "Pushing docker image with $DOCKER_TAG:$VERSION and $DOCKER_TAG:latest..."
+    echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+    docker push $DOCKER_TAG:$VERSION
+    docker push $DOCKER_TAG:latest
+fi
+
+rm -f ./*.gem
+
+echo "DONE"

data/conf.d/file/source.containers.conf

@@ -0,0 +1,64 @@
+<source>
+  @type tail
+  format json
+  time_key "#{ENV['TIME_KEY']}"
+  path "#{ENV['CONTAINER_LOGS_PATH']}"
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-containers.log.pos
+  time_format %Y-%m-%dT%H:%M:%S.%NZ
+  tag containers.*
+  read_from_head "#{ENV['READ_FROM_HEAD']}"
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter containers.**>
+  @type concat
+  key log
+  multiline_start_regexp "#{ENV['MULTILINE_START_REGEXP']}"
+  separator "#{ENV['CONCAT_SEPARATOR']}"
+  timeout_label @NORMAL
+</filter>
+
+<match containers.**>
+  @type relabel
+  @label @NORMAL
+</match>
+
+<label @NORMAL>
+  <filter containers.**>
+    @type kubernetes_metadata
+    @log_level warn
+    annotation_match ["sumologic\.com.*"]
+    de_dot false
+    watch "#{ENV['K8S_METADATA_FILTER_WATCH']}"
+    ca_file "#{ENV['K8S_METADATA_FILTER_CA_FILE']}"
+    verify_ssl "#{ENV['K8S_METADATA_FILTER_VERIFY_SSL']}"
+    client_cert "#{ENV['K8S_METADATA_FILTER_CLIENT_CERT']}"
+    client_key "#{ENV['K8S_METADATA_FILTER_CLIENT_KEY']}"
+    bearer_token_file "#{ENV['K8S_METADATA_FILTER_BEARER_TOKEN_FILE']}"
+    cache_size "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_SIZE']}"
+    cache_ttl "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_TTL']}"
+    tag_to_kubernetes_name_regexp '.+?\.containers\.(?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$'
+    merge_json_log false
+  </filter>
+
+  <filter containers.**>
+    @type kubernetes_sumologic
+    source_name "#{ENV['SOURCE_NAME']}"
+    source_host "#{ENV['SOURCE_HOST']}"
+    log_format "#{ENV['LOG_FORMAT']}"
+    kubernetes_meta "#{ENV['KUBERNETES_META']}"
+    kubernetes_meta_reduce "#{ENV['KUBERNETES_META_REDUCE']}"
+    add_stream "#{ENV['ADD_STREAM']}"
+    add_time "#{ENV['ADD_TIME']}"
+    source_category "#{ENV['SOURCE_CATEGORY']}"
+    source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+    source_category_replace_dash "#{ENV['SOURCE_CATEGORY_REPLACE_DASH']}"
+    exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    exclude_pod_regex "#{ENV['EXCLUDE_POD_REGEX']}"
+    exclude_container_regex "#{ENV['EXCLUDE_CONTAINER_REGEX']}"
+    exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  </filter>
+  
+  @include /fluentd/conf.d/out.sumo.conf
+</label>

data/conf.d/file/source.docker.conf

@@ -0,0 +1,20 @@
+# Examples:
+# time="2016-02-04T06:51:03.053580605Z" level=info msg="GET /containers/json"
+# time="2016-02-04T07:53:57.505612354Z" level=error msg="HTTP Error" err="No such image: -f" statusCode=404
+<source>
+  @type tail
+  format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
+  time_format %Y-%m-%dT%H:%M:%S.%NZ
+  path /var/lib/docker.log
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-docker.log.pos
+  tag docker
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter docker.**>
+  @type kubernetes_sumologic
+  source_category docker
+  source_name k8s_docker
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+</filter>

data/conf.d/file/source.kubernetes.conf

@@ -0,0 +1,158 @@
+# Example:
+# 2015-12-21 23:17:22,066 [salt.state       ][INFO    ] Completed state [net.ipv4.ip_forward] at time 23:17:22.066081
+<source>
+  @type tail
+  format /^(?<time>[^ ]* [^ ,]*)[^\[]*\[[^\]]*\]\[(?<severity>[^ \]]*) *\] (?<message>.*)$/
+  time_format %Y-%m-%d %H:%M:%S
+  path /mnt/log/salt/minion
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-salt.pos
+  tag salt
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter salt.**>
+  @type kubernetes_sumologic
+  source_category salt
+  source_name k8s_salt
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>
+
+
+# Example:
+# Dec 21 23:17:22 gke-foo-1-1-4b5cbd14-node-4eoj startupscript: Finished running startup script /var/run/google.startup.script
+<source>
+  @type tail
+  format syslog
+  path /mnt/log/startupscript.log
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-startupscript.log.pos
+  tag startupscript
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter startupscript.**>
+  @type kubernetes_sumologic
+  source_category startupscript
+  source_name k8s_startupscript
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>
+
+
+# Multi-line parsing is required for all the kube logs because very large log
+# statements, such as those that include entire object bodies, get split into
+# multiple lines by glog.
+
+
+# Example:
+# I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537]
+<source>
+  @type tail
+  format multiline
+  multiline_flush_interval 5s
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /mnt/log/kubelet.log
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-kubelet.log.pos
+  tag kubelet
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter kubelet.**>
+  @type kubernetes_sumologic
+  source_category kubelet
+  source_name k8s_kubelet
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>
+
+
+# Example
+# 2017-11-06T18:53:49.774520188Z AUDIT: id="6a8sdffd918-0b6a-4aee-a3a1-f1sdf61596" ip="172.11.23.88" method="GET" user="kubelet" groups="\"system:nodes\",\"system:authenticated\"" as="<self>" asgroups="<lookup>" namespace="monty" uri="/api/v1/namespaces/monty/secrets/default-token-fntvb?resourceVersion=0"
+# 2017-02-09T00:15:57.993528822Z AUDIT: id="6a8sdffd918-0b6a-4aee-a3a1-f1sdf61596" response="200"
+<source>
+  @type tail
+  format json
+  time_key timestamp
+  time_format %Y-%m-%dT%H:%M:%SZ
+  path "#{ENV['AUDIT_LOG_PATH']}"
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-kube-audit.log.pos
+  tag kube-audit
+  read_from_head "#{ENV['READ_FROM_HEAD']}"
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter kube-audit.**>
+  @type kubernetes_sumologic
+  source_category kube-audit
+  source_name k8s_kube-audit
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>
+
+
+# Example:
+# I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
+<source>
+  @type tail
+  format multiline
+  multiline_flush_interval 5s
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /mnt/log/glbc.log
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-glbc.log.pos
+  tag glbc
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter glbc.**>
+  @type kubernetes_sumologic
+  source_category glbc
+  source_name k8s_glbc
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>
+
+
+# Example:
+# I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
+<source>
+  @type tail
+  format multiline
+  multiline_flush_interval 5s
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /mnt/log/cluster-autoscaler.log
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-cluster-autoscaler.log.pos
+  tag cluster-autoscaler
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter cluster-autoscaler.**>
+  @type kubernetes_sumologic
+  source_category cluster-autoscaler
+  source_name k8s_cluster-autoscaler
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+</filter>

data/conf.d/out.sumo.conf

@@ -0,0 +1,13 @@
+<match **>
+  @type sumologic
+  log_key log
+  endpoint "#{ENV['COLLECTOR_URL']}"
+  verify_ssl "#{ENV['VERIFY_SSL']}"
+  log_format "#{ENV['LOG_FORMAT']}"
+  flush_interval "#{ENV['FLUSH_INTERVAL']}"
+  num_threads "#{ENV['NUM_THREADS']}"
+  open_timeout 60
+  add_timestamp "#{ENV['ADD_TIMESTAMP']}"
+  timestamp_key "#{ENV['TIMESTAMP_KEY']}"
+  proxy_uri "#{ENV['PROXY_URI']}"
+</match>

data/conf.d/systemd/source.containers.conf

@@ -0,0 +1,47 @@
+<source>
+  @type tail
+  format json
+  time_key "#{ENV['TIME_KEY']}"
+  path "#{ENV['CONTAINER_LOGS_PATH']}"
+  exclude_path "#{ENV['EXCLUDE_PATH']}"
+  pos_file /mnt/pos/ggcp-containers.log.pos
+  time_format %Y-%m-%dT%H:%M:%S.%NZ
+  tag containers.*
+  read_from_head "#{ENV['READ_FROM_HEAD']}"
+  enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+</source>
+
+<filter containers.**>
+  @type kubernetes_metadata
+  @log_level warn
+  annotation_match ["sumologic\.com.*"]
+  de_dot false
+  watch "#{ENV['K8S_METADATA_FILTER_WATCH']}"
+  ca_file "#{ENV['K8S_METADATA_FILTER_CA_FILE']}"
+  verify_ssl "#{ENV['K8S_METADATA_FILTER_VERIFY_SSL']}"
+  client_cert "#{ENV['K8S_METADATA_FILTER_CLIENT_CERT']}"
+  client_key "#{ENV['K8S_METADATA_FILTER_CLIENT_KEY']}"
+  bearer_token_file "#{ENV['K8S_METADATA_FILTER_BEARER_TOKEN_FILE']}"
+  cache_size "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_SIZE']}"
+  cache_ttl "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_TTL']}"
+  tag_to_kubernetes_name_regexp '.+?\.containers\.(?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$'
+  merge_json_log false
+</filter>
+
+<filter containers.**>
+  @type kubernetes_sumologic
+  source_name "#{ENV['SOURCE_NAME']}"
+  source_host "#{ENV['SOURCE_HOST']}"
+  log_format "#{ENV['LOG_FORMAT']}"
+  kubernetes_meta "#{ENV['KUBERNETES_META']}"
+  kubernetes_meta_reduce "#{ENV['KUBERNETES_META_REDUCE']}"
+  add_stream "#{ENV['ADD_STREAM']}"
+  add_time "#{ENV['ADD_TIME']}"
+  source_category "#{ENV['SOURCE_CATEGORY']}"
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  source_category_replace_dash "#{ENV['SOURCE_CATEGORY_REPLACE_DASH']}"
+  exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+  exclude_pod_regex "#{ENV['EXCLUDE_POD_REGEX']}"
+  exclude_container_regex "#{ENV['EXCLUDE_CONTAINER_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+</filter>

data/conf.d/systemd/source.systemd.conf

@@ -0,0 +1,1088 @@
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "addon-config.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/addon-config.log.pos
+  </storage>
+  tag addon-config
+</source>
+
+<filter addon-config.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name addon-config
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "addon-run.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/addon-run.log.pos
+  </storage>
+  tag addon-run
+</source>
+
+<filter addon-run.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name addon-run
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "cfn-etcd-environment.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/cfn-etcd-environment.log.pos
+  </storage>
+  tag cfn-etcd-environment
+</source>
+
+<filter cfn-etcd-environment.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name cfn-etcd-environment
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "cfn-signal.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/cfn-signal.log.pos
+  </storage>
+  tag cfn-signal
+</source>
+
+<filter cfn-signal.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name cfn-signal
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "clean-ca-certificates.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/clean-ca-certificates.log.pos
+  </storage>
+  tag clean-ca-certificates
+</source>
+
+<filter clean-ca-certificates.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name clean-ca-certificates
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "containerd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/containerd.log.pos
+  </storage>
+  tag containerd
+</source>
+
+<filter containerd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name containerd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "coreos-metadata.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/coreos-metadata.log.pos
+  </storage>
+  tag coreos-metadata
+</source>
+
+<filter coreos-metadata.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name coreos-metadata
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "coreos-setup-environment.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/coreos-setup-environment.log.pos
+  </storage>
+  tag coreos-setup-environment
+</source>
+
+<filter coreos-setup-environment.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name coreos-setup-environment
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "coreos-tmpfiles.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/coreos-tmpfiles.log.pos
+  </storage>
+  tag coreos-tmpfiles
+</source>
+
+<filter coreos-tmpfiles.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name coreos-tmpfiles
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "dbus.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/dbus.log.pos
+  </storage>
+  tag dbus
+</source>
+
+<filter dbus.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name dbus
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "docker.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/docker.log.pos
+  </storage>
+  tag docker
+</source>
+
+<filter docker.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name docker
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "efs.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/efs.log.pos
+  </storage>
+  tag efs
+</source>
+
+<filter efs.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name efs
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcd-member.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcd-member.log.pos
+  </storage>
+  tag etcd-member
+</source>
+
+<filter etcd-member.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcd-member
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcd.log.pos
+  </storage>
+  tag etcd
+</source>
+
+<filter etcd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcd2.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcd2.log.pos
+  </storage>
+  tag etcd2
+</source>
+
+<filter etcd2.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcd2
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcd3.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcd3.log.pos
+  </storage>
+  tag etcd3
+</source>
+
+<filter etcd3.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcd3
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcdadm-check.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcdadm-check.log.pos
+  </storage>
+  tag etcdadm-check
+</source>
+
+<filter etcdadm-check.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcdadm-check
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcdadm-reconfigure.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcdadm-reconfigure.log.pos
+  </storage>
+  tag etcdadm-reconfigure
+</source>
+
+<filter etcdadm-reconfigure.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcdadm-reconfigure
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcdadm-save.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcdadm-save.log.pos
+  </storage>
+  tag etcdadm-save
+</source>
+
+<filter etcdadm-save.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcdadm-save
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "etcdadm-update-status.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/etcdadm-update-status.log.pos
+  </storage>
+  tag etcdadm-update-status
+</source>
+
+<filter etcdadm-update-status.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name etcdadm-update-status
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "flanneld.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/flanneld.log.pos
+  </storage>
+  tag flanneld
+</source>
+
+<filter flanneld.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name flanneld
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "format-etcd2-volume.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/format-etcd2-volume.log.pos
+  </storage>
+  tag format-etcd2-volume
+</source>
+
+<filter format-etcd2-volume.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name format-etcd2-volume
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "kube-node-taint-and-uncordon.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/kube-node-taint-and-uncordon.log.pos
+  </storage>
+  tag kube-node-taint-and-uncordon
+</source>
+
+<filter kube-node-taint-and-uncordon.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name kube-node-taint-and-uncordon
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+# Multi-line parsing is required for all the kube logs because very large log
+# statements, such as those that include entire object bodies, get split into
+# multiple lines by glog.
+
+# Example:
+# I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537]
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "kubelet.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/kubelet.log.pos
+  </storage>
+  tag kubelet
+</source>
+
+<filter kubelet.**>
+  @type kubernetes_sumologic
+  source_category kubelet
+  source_name k8s_kubelet
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "ldconfig.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/ldconfig.log.pos
+  </storage>
+  tag ldconfig
+</source>
+
+<filter ldconfig.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name ldconfig
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "locksmithd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/locksmithd.log.pos
+  </storage>
+  tag locksmithd
+</source>
+
+<filter locksmithd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name locksmithd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "logrotate.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/logrotate.log.pos
+  </storage>
+  tag logrotate
+</source>
+
+<filter logrotate.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name logrotate
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "lvm2-monitor.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/lvm2-monitor.log.pos
+  </storage>
+  tag lvm2-monitor
+</source>
+
+<filter lvm2-monitor.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name lvm2-monitor
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "mdmon.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/mdmon.log.pos
+  </storage>
+  tag mdmon
+</source>
+
+<filter mdmon.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name mdmon
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "nfs-idmapd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/nfs-idmapd.log.pos
+  </storage>
+  tag nfs-idmapd
+</source>
+
+<filter nfs-idmapd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name nfs-idmapd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "nfs-mountd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/nfs-mountd.log.pos
+  </storage>
+  tag nfs-mountd
+</source>
+
+<filter nfs-mountd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name nfs-mountd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "nfs-server.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/nfs-server.log.pos
+  </storage>
+  tag nfs-server
+</source>
+
+<filter nfs-server.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name nfs-server
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "nfs-utils.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/nfs-utils.log.pos
+  </storage>
+  tag nfs-utils
+</source>
+
+<filter nfs-utils.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name nfs-utils
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "oem-cloudinit.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/oem-cloudinit.log.pos
+  </storage>
+  tag oem-cloudinit
+</source>
+
+<filter oem-cloudinit.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name oem-cloudinit
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rkt-gc.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rkt-gc.log.pos
+  </storage>
+  tag rkt-gc
+</source>
+
+<filter rkt-gc.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rkt-gc
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rkt-metadata.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rkt-metadata.log.pos
+  </storage>
+  tag rkt-metadata
+</source>
+
+<filter rkt-metadata.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rkt-metadata
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rpc-idmapd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rpc-idmapd.log.pos
+  </storage>
+  tag rpc-idmapd
+</source>
+
+<filter rpc-idmapd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rpc-idmapd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rpc-mountd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rpc-mountd.log.pos
+  </storage>
+  tag rpc-mountd
+</source>
+
+<filter rpc-mountd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rpc-mountd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rpc-statd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rpc-statd.log.pos
+  </storage>
+  tag rpc-statd
+</source>
+
+<filter rpc-statd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rpc-statd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "rpcbind.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/rpcbind.log.pos
+  </storage>
+  tag rpcbind
+</source>
+
+<filter rpcbind.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name rpcbind
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "set-aws-environment.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/set-aws-environment.log.pos
+  </storage>
+  tag set-aws-environment
+</source>
+
+<filter set-aws-environment.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name set-aws-environment
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "system-cloudinit.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/system-cloudinit.log.pos
+  </storage>
+  tag system-cloudinit
+</source>
+
+<filter system-cloudinit.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name system-cloudinit
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "update-ca-certificates.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/update-ca-certificates.log.pos
+  </storage>
+  tag update-ca-certificates
+</source>
+
+<filter update-ca-certificates.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name update-ca-certificates
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "user-cloudinit.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/user-cloudinit.log.pos
+  </storage>
+  tag user-cloudinit
+</source>
+
+<filter user-cloudinit.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name user-cloudinit
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "var-lib-etcd2.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/var-lib-etcd2.log.pos
+  </storage>
+  tag var-lib-etcd2
+</source>
+
+<filter var-lib-etcd2.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name var-lib-etcd2
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "ntp.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/ntp.log.pos
+  </storage>
+  tag ntp
+</source>
+
+<filter ntp.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name ntp
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+
+<source>
+  @type systemd
+  path /mnt/log/journal
+  filters [{"_SYSTEMD_UNIT": "systemd-timesyncd.service"}]
+  <storage>
+    @type local
+    persistent true
+    path /mnt/pos/systemd-timesyncd.log.pos
+  </storage>
+  tag systemd-timesyncd
+</source>
+
+<filter systemd-timesyncd.**>
+  @type kubernetes_sumologic
+  source_category system
+  source_name systemd-timesyncd
+  source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+  exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+  exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+  exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+  exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+</filter>
+