diff --git a/docs/best-practices.md b/docs/best-practices.md index b80c00ea58..be97b519b0 100644 --- a/docs/best-practices.md +++ b/docs/best-practices.md @@ -12,6 +12,7 @@ - [Fluentd](#fluentd-1) - [OpenTelemetry Collector](#opentelemetry-collector-1) - [Collect logs from additional files on the Node](#collect-logs-from-additional-files-on-the-node) +- [Remove attributes from systemd logs](#removing-attributes-from-systemd-logs) - [Filtering Prometheus Metrics by Namespace](#filtering-prometheus-metrics-by-namespace) - [Modify the Log Level for Falco](#modify-the-log-level-for-falco) - [Overriding metadata using annotations](#overriding-metadata-using-annotations) @@ -353,6 +354,24 @@ In the example above, two internally defined processors were used in metadata pi [memory limiter](https://github.com/open-telemetry/opentelemetry-collector/tree/v0.73.0/processor/memorylimiterprocessor). If you need to change the parameters of these processors in any way, you can define your own and use them in this pipeline. +## Removing attributes from systemd logs + +If you want to remove some attributes from Systemd logs, like for example `PRIORITY` and `SYSLOG_FACILITY`, you can do it the following way: + +```yaml +sumologic: + logs: + systemd: + otelcol: + extraProcessors: + - transform/cleanup_systemd: + log_statements: + - context: log + statements: + - delete_key(body, "PRIORITY") + - delete_key(body, "SYSLOG_FACILITY") +``` + ## Filtering Prometheus Metrics by Namespace If you want to filter metrics by namespace, it can be done in the prometheus remote write config. Here is an example of excluding kube-state