Docs

Volcengine Kubernetes Engine

Product Announcement

[Product update] Description of changes in key-value indexed fields of VCI logs

To better support and adapt to the container log collection capabilities provided by TLS, VCI will upgrade the log collection add-on. After the add-on is upgraded, the key-value indexed fields of container logs will change, which will affect all features involving log queries.

Tips

If you have not enabled the log collection feature in VCI, you can ignore this change. For instructions on enabling the log collection feature in VCI, see Log collection rules.

The log collection add-on of VCI is upgraded based on the following schedule:

China (Beijing): The upgrade started at 14:00 on March 30, 2023.

China (Guangzhou): The upgrade starts at 14:00 on March 29, 2023.

China (Shanghai): The upgrade starts at 14:00 on March 28, 2023.

Change details of the key values and index fields of the container logs

Tip

The following table describes the changes in the key-value indexed fields of container logs for VCI pods. For details on the key-value indexed fields of container logs for VKE pods, see [Product update] of VKE.

Key values and index fields of the container log			Changed	Field description
Previous version	New version		Changed	Field description
__path__	__path__	No	The log file path.
cluster_id	cluster_id	No	The ID of the cluster to which the pod belongs.
__source__	__source__	No	The IP address of the log source server.
host_ip	host_ip	No	The IP of the host to which Pod belongs, which is the Node IP.
container_source	__container_source__	Yes	Log source.
namespace	__namespace__	Yes	Name of the namespace to which Pod belongs
pod_ip	No	Deleted	This indexed field is deleted. Instead, __container_ip__ is used to indicate the pod IP address.
container_ip	__container_ip__	Yes	The pod IP address.
pod_name	__ pod_name__	Yes	Pod name.
pod_uid	__ pod_uid__	Yes	The only label of Pod.
container_name	__container_name__	Yes	Container name.
image_name	__image_name__	Yes	Image name.
content	__content__	Yes	Contents of the logs.

Impact

Log query

This upgrade affects operations on container logs, such as console queries, API queries, alert queries, and dashboard queries.

Tip

Key-value indexed field changes in this upgrade do not support querying or analyzing data during the upgrade period. If you have requirements for querying data both before and after the upgrade, submit a TLS ticket.

If you need to query historical log data for existing VCI instances that had the log collection feature enabled before the upgrade, you need to use the old version of the field names. The time range for this data can be any period before the upgrade. The example is as follows:

pod_ip:"172.**.**.**" |select count(*) AS num

To query log data from VCIs with enabled log collection after the upgrade, use the new field names. The data time range must be any period after the upgrade. Example:

__container_ip__:"172.**.**.**" |select count(*) AS num

When it comes to the retrieval of the built-in metadata fields, such as__pod_name__, you need to carry out retrievals through the __pod_name__: "*****" format. The keyword retrieval of the full text is not supported.

Cost description

This upgrade does not incur additional costs.

Last updated: 2026.03.16 14:55:25