Events Relabel Rules

Events relabel rules run on every incoming event before Kloudfuse stores it. Use them to drop noisy events, to add labels such as an owning team, and to send events to a retention policy. For the rule fields, actions, and evaluation order, see How Relabel Rules Work.

One set of rules applies to events from every source:

  • Events sent by the Datadog Agent.

  • Kubernetes events sent over OTLP.

  • AWS EventBridge events.

  • GitHub events.

Configure the rules

Add the rules to ingester.config.events.relabelConfigs in your custom-values.yaml file:

ingester:
  config:
    events:
      relabelConfigs:
        - source_labels: [kube_namespace]
          regex: "load-test-.*"
          action: drop
yaml

Then apply the change:

helm upgrade --install kfuse oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/kfuse \
  -n kfuse \
  --version <VERSION> \ (1)
  -f custom-values.yaml
bash
1 Replace <VERSION> with a valid Kloudfuse release value. See Release Notes for the latest release.

Labels the rules see

Rules see the event’s labels. Which labels an event has depends on its source. Kubernetes events, for example, carry labels such as kube_cluster_name, kube_namespace, kube_deployment, pod_name, source_component, and reporting_controller. To see the labels on your events, open the Events Explorer.

Labels added by an ingestion API key are also visible. Rules can match these labels but cannot change them.

Examples

Each example shows a single rule. You can list as many rules as you need; they run in order.

Drop events from a namespace

Stop storing events from namespaces whose names start with load-test-:

- source_labels: [kube_namespace]
  regex: "load-test-.*"
  action: drop
yaml

Drop events from one controller in one cluster

Stop storing events reported by the cluster-autoscaler in the staging cluster:

- source_labels: [kube_cluster_name, reporting_controller]
  regex: "staging;cluster-autoscaler"
  action: drop
yaml

Add a team label

Label events from the payments and checkout namespaces with team: commerce:

- source_labels: [kube_namespace]
  regex: "payments|checkout"
  target_label: team
  replacement: commerce
yaml

Assign a retention policy

Keep events from the prod cluster under the prod retention policy. The policy must be defined in global.retentionPolicy.events.custom; see Configure relabel rules:

- source_labels: [kube_cluster_name]
  regex: "prod"
  action: retention
  retention_policy: prod
yaml

Check the result

Events dropped by a rule appear in the Consumption Tracking dashboard with the drop reason relabel.