Add note to s/docker/cri if CRI is used (#76)

If containerd or CRIO is used, the cri parser should be utilized.

Add the parser, and give a hint to users in the README.

Parser is from:
https://github.com/fluent/fluent-bit/blob/30b7a030544f56ccabae7a4d698b01c7d0f0b250/conf/parsers.conf#L106-L112

Signed-off-by: Eric Ernst <[email protected]>

Co-authored-by: Eric Ernst <[email protected]>

Author: egernst

README.md

@@ -35,6 +35,8 @@ The next step is to create a ConfigMap that will be used by our Fluent Bit Daemo
 $ kubectl create -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/elasticsearch/fluent-bit-configmap.yaml
 ```
 
+If the cluster uses a CRI runtime, like containerd or CRI-O, change the `Parser` described in `input-kubernetes.conf` from docker to cri.
+
 Fluent Bit DaemonSet ready to be used with Elasticsearch on a normal Kubernetes Cluster:
 
 ```

output/elasticsearch/fluent-bit-configmap.yaml

@@ -96,6 +96,14 @@ data:
         Time_Format %Y-%m-%dT%H:%M:%S.%L
         Time_Keep   On
 
+    [PARSER]
+        # http://rubular.com/r/tjUt3Awgg4
+        Name cri
+        Format regex
+        Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L%z
+
     [PARSER]
         Name        syslog
         Format      regex