Extracting machine data generated by an isolated execution environment from a chunk of data generated by an isolated execution environment manager

A computing system, comprising:

• non-transitory computer-readable media;
• and
• one or more processing devices communicatively coupled to the non-transitory computer-readable media and configured to:
• obtain a chunk of data from a host computing system, the host computing system comprising:
• one or more processing devices,
• a plurality of containers executing on the one or more processing devices, and
• a container manager executing on at least one of the one or more processing devices, wherein the container manager is communicatively coupled with the plurality of containers and is configured to manage resource allocation of the host computing system;
• identify one or more first regular expression rules based on a determined characteristic of the chunk of data;
• parse the chunk of data using the one or more first regular expression rules to identify machine data generated by a container of the plurality of containers and machine data generated by the container manager;
• extract the machine data generated by the container from the chunk of data;
• and
• communicate the extracted machine data generated by the container to one or more components of a data intake and query system for processing and storage, wherein the one or more components of the data intake and query system generate one or more events based on the extracted machine data generated by the container, wherein an event of the one or more events includes at least a portion of the extracted machine data generated by the container, wherein the data intake and query system parses the extracted machine data generated by the container using one or more second regular expression rules that are different from the one or more first regular expression rules.

Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:

• obtain a chunk of data from a host computing system, the host computing system comprising:
• one or more processing devices,
• a plurality of containers executing on the one or more processing devices, and
• a container manager executing on at least one of the one or more processing devices, wherein the container manager is communicatively coupled with the plurality of containers and is configured to manage resource allocation of the host computing system;
• identify one or more first regular expression rules based on a determined characteristic of the chunk of data;
• parse the chunk of data using the one or more first regular expression rules to identify machine data generated by a container of the plurality of containers and machine data generated by the container manager;
• extract the machine data generated by the container from the chunk of data;
• and
• communicate the extracted machine data generated by the container to one or more components of a data intake and query system for processing and storage, wherein the one or more components of the data intake and query system generate one or more events based on the extracted machine data generated by the container, wherein an event of the one or more events includes at least a portion of the extracted machine data generated by the container, wherein the data intake and query system parses the extracted machine data generated by the container using one or more second regular expression rules that are different from the one or more first regular expression rules.