{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "slug": "dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations", "url": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/" }, "title": "Check every Fluent Bit collector before enabling pod log-exclusion annotations", "summary": "Can a pod annotation intended for Container Insights also stop another log collector?", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:31+00:00", "modified_at": "2026-09-10T02:04:58+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Supported ConfigMap-based Container Insights deployments sharing pods with another Fluent Bit collection solution.", "dse_recommendation": "Inventory all collectors that honor the pod's exclusion annotations before using them to reduce one pipeline's output.", "primary_source": { "name": "Configure container log collection with ConfigMap - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configmap", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Container Insights supports Fluent Bit-based pod annotations that exclude container output after annotation filtering is enabled in its ConfigMap. Microsoft warns that an independent Fluent Bit solution using the Kubernetes plugin filter and annotation-based exclusion also stops collecting the annotated logs. The setting is therefore not necessarily exclusive to Container Insights. AKS Automatic clusters with managed system node pools do not support this ConfigMap configuration path. Microsoft Learn.

\n

Applicability

\n

Review supported clusters where more than one collector observes the same workload. Identify which solutions actually honor the annotations rather than assuming that every collector does, or that only the intended one does.

\n

DSE recommendation

\n

Inventory all collectors that honor the pod’s exclusion annotations before using them to reduce one pipeline’s output. Ask each destination owner whether losing those records is acceptable. If one pipeline must retain the data, resolve that requirement with the collector owners before deploying the annotation. Keep the workload manifest and collection configuration in the same review so an application change does not silently remove another team’s evidence.

\n

Verification

\n

Use a test pod with recognizable benign stdout and stderr messages. Inspect the intended destination and every other relevant destination before and after the approved annotation change. Record each collector’s configuration and observed result. Accept the change only when the resulting exclusions match the agreed collection design; reduced volume in Container Insights alone does not verify the other pipeline’s required continuity.

\n

Official references

\n

Microsoft Learn: Container log ConfigMap configuration. Source reviewed September 9, 2026.

", "content_text": "Source facts\nContainer Insights supports Fluent Bit-based pod annotations that exclude container output after annotation filtering is enabled in its ConfigMap. Microsoft warns that an independent Fluent Bit solution using the Kubernetes plugin filter and annotation-based exclusion also stops collecting the annotated logs. The setting is therefore not necessarily exclusive to Container Insights. AKS Automatic clusters with managed system node pools do not support this ConfigMap configuration path. Microsoft Learn.\nApplicability\nReview supported clusters where more than one collector observes the same workload. Identify which solutions actually honor the annotations rather than assuming that every collector does, or that only the intended one does.\nDSE recommendation\nInventory all collectors that honor the pod’s exclusion annotations before using them to reduce one pipeline’s output. Ask each destination owner whether losing those records is acceptable. If one pipeline must retain the data, resolve that requirement with the collector owners before deploying the annotation. Keep the workload manifest and collection configuration in the same review so an application change does not silently remove another team’s evidence.\nVerification\nUse a test pod with recognizable benign stdout and stderr messages. Inspect the intended destination and every other relevant destination before and after the approved annotation change. Record each collector’s configuration and observed result. Accept the change only when the resulting exclusions match the agreed collection design; reduced volume in Container Insights alone does not verify the other pipeline’s required continuity.\nOfficial references\nMicrosoft Learn: Container log ConfigMap configuration. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nContainer Insights supports Fluent Bit-based pod annotations that exclude container output after annotation filtering is enabled in its ConfigMap. Microsoft warns that an independent Fluent Bit solution using the Kubernetes plugin filter and annotation-based exclusion also stops collecting the annotated logs. The setting is therefore not necessarily exclusive to Container Insights. AKS Automatic clusters with managed system node pools do not support this ConfigMap configuration path. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configmap).\n\n## Applicability\n\nReview supported clusters where more than one collector observes the same workload. Identify which solutions actually honor the annotations rather than assuming that every collector does, or that only the intended one does.\n\n## DSE recommendation\n\nInventory all collectors that honor the pod’s exclusion annotations before using them to reduce one pipeline’s output. Ask each destination owner whether losing those records is acceptable. If one pipeline must retain the data, resolve that requirement with the collector owners before deploying the annotation. Keep the workload manifest and collection configuration in the same review so an application change does not silently remove another team’s evidence.\n\n## Verification\n\nUse a test pod with recognizable benign stdout and stderr messages. Inspect the intended destination and every other relevant destination before and after the approved annotation change. Record each collector’s configuration and observed result. Accept the change only when the resulting exclusions match the agreed collection design; reduced volume in Container Insights alone does not verify the other pipeline’s required continuity.\n\n## Official references\n\n[Microsoft Learn: Container log ConfigMap configuration](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configmap). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "url": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check every Fluent Bit collector before enabling pod log-exclusion annotations", "item": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "url": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/", "headline": "Check every Fluent Bit collector before enabling pod log-exclusion annotations", "description": "Can a pod annotation intended for Container Insights also stop another log collector?", "abstract": "Can a pod annotation intended for Container Insights also stop another log collector?", "articleBody": "Source facts\nContainer Insights supports Fluent Bit-based pod annotations that exclude container output after annotation filtering is enabled in its ConfigMap. Microsoft warns that an independent Fluent Bit solution using the Kubernetes plugin filter and annotation-based exclusion also stops collecting the annotated logs. The setting is therefore not necessarily exclusive to Container Insights. AKS Automatic clusters with managed system node pools do not support this ConfigMap configuration path. Microsoft Learn.\nApplicability\nReview supported clusters where more than one collector observes the same workload. Identify which solutions actually honor the annotations rather than assuming that every collector does, or that only the intended one does.\nDSE recommendation\nInventory all collectors that honor the pod’s exclusion annotations before using them to reduce one pipeline’s output. Ask each destination owner whether losing those records is acceptable. If one pipeline must retain the data, resolve that requirement with the collector owners before deploying the annotation. Keep the workload manifest and collection configuration in the same review so an application change does not silently remove another team’s evidence.\nVerification\nUse a test pod with recognizable benign stdout and stderr messages. Inspect the intended destination and every other relevant destination before and after the approved annotation change. Record each collector’s configuration and observed result. Accept the change only when the resulting exclusions match the agreed collection design; reduced volume in Container Insights alone does not verify the other pipeline’s required continuity.\nOfficial references\nMicrosoft Learn: Container log ConfigMap configuration. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:31+00:00", "dateModified": "2026-09-10T02:04:58+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-445-check-every-fluent-bit-collector-before-enabling-pod-log-exclusion-annotations/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check every Fluent Bit collector before enabling pod log-exclusion annotations" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Information priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure container log collection with ConfigMap - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configmap" } } ] } }