Filter on systemd not working

[rucciva]

Bug Report

Filter section is not executed when using systemd

To Reproduce

• create config that use rewrite tag to change systemd tag

[Input]
    Name    systemd
    Tag    systemd.*
    Systemd_Filter    _SYSTEMD_UNIT=containerd.service
    Systemd_Filter    _SYSTEMD_UNIT=kubelet.service
[Filter]
    Name    rewrite_tag
    Match    systemd.*
    Rule    $log (.+) loki.$TAG false
    Emitter_Name    systemd_loki
[OUTPUT]
    Name   stdout
    Match  systemd.*

• run fluentbit with said config

Expected behavior
No output are generated since the filter is executed and the tag is rewritten

Screenshots

Your Environment

• Version used: 2.0.11
• Configuration: as above
• Environment name and version (e.g. Kubernetes? What version?): kubernetes 1.23 with fluent operator 2.2
• Server type and version:
• Operating System and version: ubuntu 18.04
• Filters and plugins: rewrite_tag and stdout

Additional context

If i change the config to this

[Input]
    Name    systemd
    Tag    systemd.*
    Systemd_Filter    _SYSTEMD_UNIT=containerd.service
    Systemd_Filter    _SYSTEMD_UNIT=kubelet.service
[Filter]
    Name    rewrite_tag
    Match    systemd.*
    Rule    $log (.+) loki.$TAG false
    Emitter_Name    systemd_loki
[OUTPUT]
    Name   stdout
    Match  loki.systemd.*

no output are displayed

[patrick-stephens]

Your output is still matching the original input: rewrite tag creates effectively a duplicate stream of it, it does not stop the current tag at that point.

[rucciva]

it does not stop the current tag at that point.

i specified keep as false (Rule $log (.+) loki.$TAG false) as noted in https://docs.fluentbit.io/manual/pipeline/filters/rewrite-tag#keep. Won't that make the original record dropped and doesn't continue in pipeline?

besides, using this output step didn't produce anything, which should output the same line if the filter match right?

[OUTPUT]
    Name   stdout
    Match  loki.systemd.*

[patrick-stephens]

Ah yeah, my bad for skimming over it on mobile.

Does the example in the docs work?
https://docs.fluentbit.io/manual/pipeline/filters/rewrite-tag#configuration-example

[rucciva]

yes the example works

[nokute78]

Could you try following Rule config ?

    Rule    $MESSAGE (.+) loki.$TAG false

Output of systemd plugin doesn't contain the key log.

[rucciva]

ah i see, thanks @nokute78 , it works