fluent-plugin-kubernetes_sumologic 2.3.2 → 2.4.0

data/daemonset/rbac/fluentd.yaml

@@ -61,11 +61,16 @@ spec:
       - name: docker-logs
         hostPath:
           path: /var/lib/docker
+      - name: fluentd-sumologic-config
+        configMap:
+          name: fluentd-sumologic-config
       containers:
-      - image: sumologic/fluentd-kubernetes-sumologic:v2.3.2
+      - image: sumologic/fluentd-kubernetes-sumologic:latest
         name: fluentd
         imagePullPolicy: Always
         volumeMounts:
+        - name: fluentd-sumologic-config
+          mountPath: /fluentd/etc
         - name: host-logs
           mountPath: /mnt/log/
           readOnly: true
@@ -83,8 +88,1469 @@ spec:
             secretKeyRef:
               name: sumologic
               key: collector-url
+        # Improve GC for memory limited envs like docker.
+        - name: RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR
+          value: "0.9"
       tolerations:
           #- operator: "Exists"
           - effect: "NoSchedule"
             key: "node-role.kubernetes.io/master"
 
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fluentd-sumologic-config
+  labels:
+    app: fluentd-sumologic
+data:
+  out.sumo.conf: |-
+    <match **>
+      @type sumologic
+      log_key log
+      endpoint "#{ENV['COLLECTOR_URL']}"
+      verify_ssl "#{ENV['VERIFY_SSL']}"
+      log_format "#{ENV['LOG_FORMAT']}"
+      flush_interval "#{ENV['FLUSH_INTERVAL']}"
+      num_threads "#{ENV['NUM_THREADS']}"
+      open_timeout 60
+      add_timestamp "#{ENV['ADD_TIMESTAMP']}"
+      timestamp_key "#{ENV['TIMESTAMP_KEY']}"
+      proxy_uri "#{ENV['PROXY_URI']}"
+    </match>
+
+  fluent.file.conf: |-
+    <match fluent.**>
+      @type null
+    </match>
+
+    <source>
+      @type monitor_agent
+      bind 0.0.0.0
+      port 24220
+    </source>
+
+    @include /fluentd/etc/file.source.*.conf
+    @include /fluentd/etc/user/*.conf
+    @include /fluentd/etc/out.sumo.conf
+
+  fluent.forward.conf: |-
+    ## built-in TCP input
+    ## $ echo <json> | fluent-cat <tag>
+    <source>
+      @type forward
+      @id forward_input
+      port "#{ENV['FORWARD_INPUT_PORT']}"
+      bind "#{ENV['FORWARD_INPUT_BIND']}"
+    </source>
+
+    <source>
+      @type monitor_agent
+      bind 0.0.0.0
+      port 24220
+    </source>
+
+    @include /fluentd/etc/forward.source.*.conf
+    @include /fluentd/etc/user/*.conf
+    @include /fluentd/etc/out.sumo.conf
+
+  fluent.systemd.conf: |-
+    <match fluent.**>
+      @type null
+    </match>
+
+    <source>
+      @type monitor_agent
+      bind 0.0.0.0
+      port 24220
+    </source>
+
+    @include /fluentd/etc/systemd.source.*.conf
+    @include /fluentd/etc/user/*.conf
+    @include /fluentd/etc/out.sumo.conf
+
+  file.source.containers.conf: |-
+    <source>
+      @type tail
+      format json
+      time_key "#{ENV['TIME_KEY']}"
+      path "#{ENV['CONTAINER_LOGS_PATH']}"
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-containers.log.pos
+      time_format %Y-%m-%dT%H:%M:%S.%NZ
+      tag containers.*
+      read_from_head "#{ENV['READ_FROM_HEAD']}"
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter containers.**>
+      @type concat
+      key log
+      multiline_start_regexp "#{ENV['MULTILINE_START_REGEXP']}"
+      separator "#{ENV['CONCAT_SEPARATOR']}"
+      timeout_label @NORMAL
+    </filter>
+
+    <match containers.**>
+      @type relabel
+      @label @NORMAL
+    </match>
+
+    <label @NORMAL>
+      <filter containers.**>
+        @type kubernetes_metadata
+        @log_level warn
+        annotation_match ["sumologic\.com.*"]
+        de_dot false
+        watch "#{ENV['K8S_METADATA_FILTER_WATCH']}"
+        ca_file "#{ENV['K8S_METADATA_FILTER_CA_FILE']}"
+        verify_ssl "#{ENV['K8S_METADATA_FILTER_VERIFY_SSL']}"
+        client_cert "#{ENV['K8S_METADATA_FILTER_CLIENT_CERT']}"
+        client_key "#{ENV['K8S_METADATA_FILTER_CLIENT_KEY']}"
+        bearer_token_file "#{ENV['K8S_METADATA_FILTER_BEARER_TOKEN_FILE']}"
+        cache_size "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_SIZE']}"
+        cache_ttl "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_TTL']}"
+        tag_to_kubernetes_name_regexp '.+?\.containers\.(?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$'
+        merge_json_log false
+      </filter>
+
+      <filter containers.**>
+        @type kubernetes_sumologic
+        source_name "#{ENV['SOURCE_NAME']}"
+        source_host "#{ENV['SOURCE_HOST']}"
+        log_format "#{ENV['LOG_FORMAT']}"
+        kubernetes_meta "#{ENV['KUBERNETES_META']}"
+        kubernetes_meta_reduce "#{ENV['KUBERNETES_META_REDUCE']}"
+        add_stream "#{ENV['ADD_STREAM']}"
+        add_time "#{ENV['ADD_TIME']}"
+        source_category "#{ENV['SOURCE_CATEGORY']}"
+        source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+        source_category_replace_dash "#{ENV['SOURCE_CATEGORY_REPLACE_DASH']}"
+        exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+        exclude_pod_regex "#{ENV['EXCLUDE_POD_REGEX']}"
+        exclude_container_regex "#{ENV['EXCLUDE_CONTAINER_REGEX']}"
+        exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      </filter>
+
+      @include /fluentd/etc/out.sumo.conf
+    </label>
+
+  file.source.docker.conf: |-
+    # Examples:
+    # time="2016-02-04T06:51:03.053580605Z" level=info msg="GET /containers/json"
+    # time="2016-02-04T07:53:57.505612354Z" level=error msg="HTTP Error" err="No such image: -f" statusCode=404
+    <source>
+      @type tail
+      format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
+      time_format %Y-%m-%dT%H:%M:%S.%NZ
+      path /var/lib/docker.log
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-docker.log.pos
+      tag docker
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter docker.**>
+      @type kubernetes_sumologic
+      source_category docker
+      source_name k8s_docker
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+    </filter>
+
+  file.source.kubernetes.conf: |-
+    # Example:
+    # 2015-12-21 23:17:22,066 [salt.state       ][INFO    ] Completed state [net.ipv4.ip_forward] at time 23:17:22.066081
+    <source>
+      @type tail
+      format /^(?<time>[^ ]* [^ ,]*)[^\[]*\[[^\]]*\]\[(?<severity>[^ \]]*) *\] (?<message>.*)$/
+      time_format %Y-%m-%d %H:%M:%S
+      path /mnt/log/salt/minion
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-salt.pos
+      tag salt
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter salt.**>
+      @type kubernetes_sumologic
+      source_category salt
+      source_name k8s_salt
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+
+    # Example:
+    # Dec 21 23:17:22 gke-foo-1-1-4b5cbd14-node-4eoj startupscript: Finished running startup script /var/run/google.startup.script
+    <source>
+      @type tail
+      format syslog
+      path /mnt/log/startupscript.log
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-startupscript.log.pos
+      tag startupscript
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter startupscript.**>
+      @type kubernetes_sumologic
+      source_category startupscript
+      source_name k8s_startupscript
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+
+    # Multi-line parsing is required for all the kube logs because very large log
+    # statements, such as those that include entire object bodies, get split into
+    # multiple lines by glog.
+
+
+    # Example:
+    # I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537]
+    <source>
+      @type tail
+      format multiline
+      multiline_flush_interval 5s
+      format_firstline /^\w\d{4}/
+      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+      time_format %m%d %H:%M:%S.%N
+      path /mnt/log/kubelet.log
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-kubelet.log.pos
+      tag kubelet
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter kubelet.**>
+      @type kubernetes_sumologic
+      source_category kubelet
+      source_name k8s_kubelet
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+
+    # Example
+    # 2017-11-06T18:53:49.774520188Z AUDIT: id="6a8sdffd918-0b6a-4aee-a3a1-f1sdf61596" ip="172.11.23.88" method="GET" user="kubelet" groups="\"system:nodes\",\"system:authenticated\"" as="<self>" asgroups="<lookup>" namespace="monty" uri="/api/v1/namespaces/monty/secrets/default-token-fntvb?resourceVersion=0"
+    # 2017-02-09T00:15:57.993528822Z AUDIT: id="6a8sdffd918-0b6a-4aee-a3a1-f1sdf61596" response="200"
+    <source>
+      @type tail
+      format json
+      time_key timestamp
+      time_format %Y-%m-%dT%H:%M:%SZ
+      path "#{ENV['AUDIT_LOG_PATH']}"
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-kube-audit.log.pos
+      tag kube-audit
+      read_from_head "#{ENV['READ_FROM_HEAD']}"
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter kube-audit.**>
+      @type kubernetes_sumologic
+      source_category kube-audit
+      source_name k8s_kube-audit
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+
+    # Example:
+    # I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
+    <source>
+      @type tail
+      format multiline
+      multiline_flush_interval 5s
+      format_firstline /^\w\d{4}/
+      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+      time_format %m%d %H:%M:%S.%N
+      path /mnt/log/glbc.log
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-glbc.log.pos
+      tag glbc
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter glbc.**>
+      @type kubernetes_sumologic
+      source_category glbc
+      source_name k8s_glbc
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+
+    # Example:
+    # I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
+    <source>
+      @type tail
+      format multiline
+      multiline_flush_interval 5s
+      format_firstline /^\w\d{4}/
+      format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+      time_format %m%d %H:%M:%S.%N
+      path /mnt/log/cluster-autoscaler.log
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-cluster-autoscaler.log.pos
+      tag cluster-autoscaler
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter cluster-autoscaler.**>
+      @type kubernetes_sumologic
+      source_category cluster-autoscaler
+      source_name k8s_cluster-autoscaler
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+    </filter>
+
+  systemd.source.containers.conf: |-
+    <source>
+      @type tail
+      format json
+      time_key "#{ENV['TIME_KEY']}"
+      path "#{ENV['CONTAINER_LOGS_PATH']}"
+      exclude_path "#{ENV['EXCLUDE_PATH']}"
+      pos_file /mnt/pos/ggcp-containers.log.pos
+      time_format %Y-%m-%dT%H:%M:%S.%NZ
+      tag containers.*
+      read_from_head "#{ENV['READ_FROM_HEAD']}"
+      enable_stat_watcher "#{ENV['ENABLE_STAT_WATCHER']}"
+    </source>
+
+    <filter containers.**>
+      @type kubernetes_metadata
+      @log_level warn
+      annotation_match ["sumologic\.com.*"]
+      de_dot false
+      watch "#{ENV['K8S_METADATA_FILTER_WATCH']}"
+      ca_file "#{ENV['K8S_METADATA_FILTER_CA_FILE']}"
+      verify_ssl "#{ENV['K8S_METADATA_FILTER_VERIFY_SSL']}"
+      client_cert "#{ENV['K8S_METADATA_FILTER_CLIENT_CERT']}"
+      client_key "#{ENV['K8S_METADATA_FILTER_CLIENT_KEY']}"
+      bearer_token_file "#{ENV['K8S_METADATA_FILTER_BEARER_TOKEN_FILE']}"
+      cache_size "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_SIZE']}"
+      cache_ttl "#{ENV['K8S_METADATA_FILTER_BEARER_CACHE_TTL']}"
+      tag_to_kubernetes_name_regexp '.+?\.containers\.(?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$'
+      merge_json_log false
+    </filter>
+
+    <filter containers.**>
+      @type kubernetes_sumologic
+      source_name "#{ENV['SOURCE_NAME']}"
+      source_host "#{ENV['SOURCE_HOST']}"
+      log_format "#{ENV['LOG_FORMAT']}"
+      kubernetes_meta "#{ENV['KUBERNETES_META']}"
+      kubernetes_meta_reduce "#{ENV['KUBERNETES_META_REDUCE']}"
+      add_stream "#{ENV['ADD_STREAM']}"
+      add_time "#{ENV['ADD_TIME']}"
+      source_category "#{ENV['SOURCE_CATEGORY']}"
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      source_category_replace_dash "#{ENV['SOURCE_CATEGORY_REPLACE_DASH']}"
+      exclude_namespace_regex "#{ENV['EXCLUDE_NAMESPACE_REGEX']}"
+      exclude_pod_regex "#{ENV['EXCLUDE_POD_REGEX']}"
+      exclude_container_regex "#{ENV['EXCLUDE_CONTAINER_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+    </filter>
+
+  systemd.source.systemd.conf: |-
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "addon-config.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/addon-config.log.pos
+      </storage>
+      tag addon-config
+    </source>
+
+    <filter addon-config.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name addon-config
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "addon-run.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/addon-run.log.pos
+      </storage>
+      tag addon-run
+    </source>
+
+    <filter addon-run.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name addon-run
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "cfn-etcd-environment.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/cfn-etcd-environment.log.pos
+      </storage>
+      tag cfn-etcd-environment
+    </source>
+
+    <filter cfn-etcd-environment.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name cfn-etcd-environment
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "cfn-signal.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/cfn-signal.log.pos
+      </storage>
+      tag cfn-signal
+    </source>
+
+    <filter cfn-signal.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name cfn-signal
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "clean-ca-certificates.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/clean-ca-certificates.log.pos
+      </storage>
+      tag clean-ca-certificates
+    </source>
+
+    <filter clean-ca-certificates.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name clean-ca-certificates
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "containerd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/containerd.log.pos
+      </storage>
+      tag containerd
+    </source>
+
+    <filter containerd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name containerd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "coreos-metadata.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/coreos-metadata.log.pos
+      </storage>
+      tag coreos-metadata
+    </source>
+
+    <filter coreos-metadata.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name coreos-metadata
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "coreos-setup-environment.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/coreos-setup-environment.log.pos
+      </storage>
+      tag coreos-setup-environment
+    </source>
+
+    <filter coreos-setup-environment.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name coreos-setup-environment
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "coreos-tmpfiles.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/coreos-tmpfiles.log.pos
+      </storage>
+      tag coreos-tmpfiles
+    </source>
+
+    <filter coreos-tmpfiles.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name coreos-tmpfiles
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "dbus.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/dbus.log.pos
+      </storage>
+      tag dbus
+    </source>
+
+    <filter dbus.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name dbus
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "docker.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/docker.log.pos
+      </storage>
+      tag docker
+    </source>
+
+    <filter docker.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name docker
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "efs.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/efs.log.pos
+      </storage>
+      tag efs
+    </source>
+
+    <filter efs.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name efs
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcd-member.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcd-member.log.pos
+      </storage>
+      tag etcd-member
+    </source>
+
+    <filter etcd-member.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcd-member
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcd.log.pos
+      </storage>
+      tag etcd
+    </source>
+
+    <filter etcd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcd2.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcd2.log.pos
+      </storage>
+      tag etcd2
+    </source>
+
+    <filter etcd2.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcd2
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcd3.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcd3.log.pos
+      </storage>
+      tag etcd3
+    </source>
+
+    <filter etcd3.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcd3
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcdadm-check.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcdadm-check.log.pos
+      </storage>
+      tag etcdadm-check
+    </source>
+
+    <filter etcdadm-check.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcdadm-check
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcdadm-reconfigure.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcdadm-reconfigure.log.pos
+      </storage>
+      tag etcdadm-reconfigure
+    </source>
+
+    <filter etcdadm-reconfigure.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcdadm-reconfigure
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcdadm-save.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcdadm-save.log.pos
+      </storage>
+      tag etcdadm-save
+    </source>
+
+    <filter etcdadm-save.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcdadm-save
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "etcdadm-update-status.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/etcdadm-update-status.log.pos
+      </storage>
+      tag etcdadm-update-status
+    </source>
+
+    <filter etcdadm-update-status.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name etcdadm-update-status
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "flanneld.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/flanneld.log.pos
+      </storage>
+      tag flanneld
+    </source>
+
+    <filter flanneld.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name flanneld
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "format-etcd2-volume.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/format-etcd2-volume.log.pos
+      </storage>
+      tag format-etcd2-volume
+    </source>
+
+    <filter format-etcd2-volume.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name format-etcd2-volume
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "kube-node-taint-and-uncordon.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/kube-node-taint-and-uncordon.log.pos
+      </storage>
+      tag kube-node-taint-and-uncordon
+    </source>
+
+    <filter kube-node-taint-and-uncordon.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name kube-node-taint-and-uncordon
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    # Multi-line parsing is required for all the kube logs because very large log
+    # statements, such as those that include entire object bodies, get split into
+    # multiple lines by glog.
+
+    # Example:
+    # I0204 07:32:30.020537    3368 server.go:1048] POST /stats/container/: (13.972191ms) 200 [[Go-http-client/1.1] 10.244.1.3:40537]
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "kubelet.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/kubelet.log.pos
+      </storage>
+      tag kubelet
+    </source>
+
+    <filter kubelet.**>
+      @type kubernetes_sumologic
+      source_category kubelet
+      source_name k8s_kubelet
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "ldconfig.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/ldconfig.log.pos
+      </storage>
+      tag ldconfig
+    </source>
+
+    <filter ldconfig.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name ldconfig
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "locksmithd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/locksmithd.log.pos
+      </storage>
+      tag locksmithd
+    </source>
+
+    <filter locksmithd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name locksmithd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "logrotate.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/logrotate.log.pos
+      </storage>
+      tag logrotate
+    </source>
+
+    <filter logrotate.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name logrotate
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "lvm2-monitor.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/lvm2-monitor.log.pos
+      </storage>
+      tag lvm2-monitor
+    </source>
+
+    <filter lvm2-monitor.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name lvm2-monitor
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "mdmon.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/mdmon.log.pos
+      </storage>
+      tag mdmon
+    </source>
+
+    <filter mdmon.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name mdmon
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "nfs-idmapd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/nfs-idmapd.log.pos
+      </storage>
+      tag nfs-idmapd
+    </source>
+
+    <filter nfs-idmapd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name nfs-idmapd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "nfs-mountd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/nfs-mountd.log.pos
+      </storage>
+      tag nfs-mountd
+    </source>
+
+    <filter nfs-mountd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name nfs-mountd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "nfs-server.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/nfs-server.log.pos
+      </storage>
+      tag nfs-server
+    </source>
+
+    <filter nfs-server.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name nfs-server
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "nfs-utils.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/nfs-utils.log.pos
+      </storage>
+      tag nfs-utils
+    </source>
+
+    <filter nfs-utils.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name nfs-utils
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "oem-cloudinit.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/oem-cloudinit.log.pos
+      </storage>
+      tag oem-cloudinit
+    </source>
+
+    <filter oem-cloudinit.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name oem-cloudinit
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rkt-gc.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rkt-gc.log.pos
+      </storage>
+      tag rkt-gc
+    </source>
+
+    <filter rkt-gc.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rkt-gc
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rkt-metadata.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rkt-metadata.log.pos
+      </storage>
+      tag rkt-metadata
+    </source>
+
+    <filter rkt-metadata.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rkt-metadata
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rpc-idmapd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rpc-idmapd.log.pos
+      </storage>
+      tag rpc-idmapd
+    </source>
+
+    <filter rpc-idmapd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rpc-idmapd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rpc-mountd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rpc-mountd.log.pos
+      </storage>
+      tag rpc-mountd
+    </source>
+
+    <filter rpc-mountd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rpc-mountd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rpc-statd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rpc-statd.log.pos
+      </storage>
+      tag rpc-statd
+    </source>
+
+    <filter rpc-statd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rpc-statd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "rpcbind.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/rpcbind.log.pos
+      </storage>
+      tag rpcbind
+    </source>
+
+    <filter rpcbind.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name rpcbind
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "set-aws-environment.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/set-aws-environment.log.pos
+      </storage>
+      tag set-aws-environment
+    </source>
+
+    <filter set-aws-environment.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name set-aws-environment
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "system-cloudinit.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/system-cloudinit.log.pos
+      </storage>
+      tag system-cloudinit
+    </source>
+
+    <filter system-cloudinit.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name system-cloudinit
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "update-ca-certificates.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/update-ca-certificates.log.pos
+      </storage>
+      tag update-ca-certificates
+    </source>
+
+    <filter update-ca-certificates.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name update-ca-certificates
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "user-cloudinit.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/user-cloudinit.log.pos
+      </storage>
+      tag user-cloudinit
+    </source>
+
+    <filter user-cloudinit.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name user-cloudinit
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "var-lib-etcd2.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/var-lib-etcd2.log.pos
+      </storage>
+      tag var-lib-etcd2
+    </source>
+
+    <filter var-lib-etcd2.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name var-lib-etcd2
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "ntp.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/ntp.log.pos
+      </storage>
+      tag ntp
+    </source>
+
+    <filter ntp.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name ntp
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>
+
+    <source>
+      @type systemd
+      path /mnt/log/journal
+      filters [{"_SYSTEMD_UNIT": "systemd-timesyncd.service"}]
+      <storage>
+        @type local
+        persistent true
+        path /mnt/pos/systemd-timesyncd.log.pos
+      </storage>
+      tag systemd-timesyncd
+    </source>
+
+    <filter systemd-timesyncd.**>
+      @type kubernetes_sumologic
+      source_category system
+      source_name systemd-timesyncd
+      source_category_prefix "#{ENV['SOURCE_CATEGORY_PREFIX']}"
+      exclude_facility_regex "#{ENV['EXCLUDE_FACILITY_REGEX']}"
+      exclude_host_regex "#{ENV['EXCLUDE_HOST_REGEX']}"
+      exclude_priority_regex "#{ENV['EXCLUDE_PRIORITY_REGEX']}"
+      exclude_unit_regex "#{ENV['EXCLUDE_UNIT_REGEX']}"
+    </filter>