How can fluent-bit add custom metadata to each event message being sent to splunk
Figured it out. You have to use a separate filter named modify. When using the helm chart, you need to add a section called rawConfig in the values.yaml and put your additional filter in between the @INCLUDE for fluent-bit-filter.conf
rawConfig: |- @INCLUDE fluent-bit-service.conf @INCLUDE fluent-bit-input.conf @INCLUDE fluent-bit-filter.conf [FILTER] Name modify Match * Add cluster devcluster @INCLUDE fluent-bit-output.conf
To those of you who work with configmap.yaml add this section:
filter.conf: | [FILTER] Name modify Match * Add KEY VALUE