title: Fluentbit Kubernetes - How to extract fields from existing logs
body: <p>I have configured EFK stack with Fluent-bit on my Kubernetes cluster. I can see the logs in Kibana.</p>
  
  <p>I also have deployed nginx pod, I can see the logs of this nginx pod also in Kibana. But all the log data are sent to a single field "log" as shown below.</p>
  
  <p><a href="https://i.stack.imgur.com/llL9t.png" rel="noreferrer"><img src="https://i.stack.imgur.com/llL9t.png" alt="enter image description here"></a></p>
  
  <p>How can I extract each field into a separate field. There is a solution for fluentd already in this question. <a href="https://stackoverflow.com/questions/42270621/kibana-how-to-extract-fields-from-existing-kubernetes-logs">Kibana - How to extract fields from existing Kubernetes logs</a></p>
  
  <p>But how can I achieve the same with fluent-bit?</p>
  
  <p>I have tried the below by adding one more FILTER section under the default FILTER section for Kubernetes, but it didn't work.</p>
  
  <blockquote>
  <pre><code>[FILTER]
      Name                parser
      Match               kube.*
      Key_name            log
      Parser              nginx
  </code></pre>
  </blockquote>
  
  <p>From this (<a href="https://github.com/fluent/fluent-bit/issues/723" rel="noreferrer">https://github.com/fluent/fluent-bit/issues/723</a>), I can see there is no grok support for fluent-bit.</p>