Why the stream is always stderr, when docker/containerd writes *.json.log

when i use docker as CRI:

{"log":"I0421 14:23:18.944348       1 node.go:172] Successfully retrieved node IP: 192.168.49.2\n","stream":"stderr","time":"2023-04-21T14:23:18.944635198Z"}
{"log":"I0421 14:23:18.944724       1 server_others.go:142] kube-proxy node IP is an IPv4 address (192.168.49.2), assume IPv4 operation\n","stream":"stderr","time":"2023-04-21T14:23:18.944838628Z"}
{"log":"W0421 14:23:19.008388       1 server_others.go:578] Unknown proxy mode \"\", assuming iptables proxy\n","stream":"stderr","time":"2023-04-21T14:23:19.008544314Z"}
{"log":"I0421 14:23:19.008581       1 server_others.go:185] Using iptables Proxier.\n","stream":"stderr","time":"2023-04-21T14:23:19.008653777Z"}
{"log":"I0421 14:23:19.008904       1 server.go:650] Version: v1.20.0\n","stream":"stderr","time":"2023-04-21T14:23:19.008963124Z"}
{"log":"I0421 14:23:19.009762       1 config.go:315] Starting service config controller\n","stream":"stderr","time":"2023-04-21T14:23:19.009986673Z"}
{"log":"I0421 14:23:19.009867       1 shared_informer.go:240] Waiting for caches to sync for service config\n","stream":"stderr","time":"2023-04-21T14:23:19.009999075Z"}
{"log":"I0421 14:23:19.009973       1 config.go:224] Starting endpoint slice config controller\n","stream":"stderr","time":"2023-04-21T14:23:19.010041688Z"}
{"log":"I0421 14:23:19.009979       1 shared_informer.go:240] Waiting for caches to sync for endpoint slice config\n","stream":"stderr","time":"2023-04-21T14:23:19.01004961Z"}
{"log":"I0421 14:23:19.110110       1 shared_informer.go:247] Caches are synced for endpoint slice config \n","stream":"stderr","time":"2023-04-21T14:23:19.110273306Z"}
{"log":"I0421 14:23:19.110120       1 shared_informer.go:247] Caches are synced for service config \n","stream":"stderr","time":"2023-04-21T14:23:19.110525274Z"}

And

when i use containerd as CRI:

2022-07-19T11:13:32.228206987+08:00 stderr F I0719 11:13:32.228176       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_max' to 524288
2022-07-19T11:13:32.228229469+08:00 stderr F I0719 11:13:32.228203       1 conntrack.go:52] Setting nf_conntrack_max to 524288
2022-07-19T11:13:32.228460095+08:00 stderr F I0719 11:13:32.228431       1 conntrack.go:83] Setting conntrack hashsize to 131072
2022-07-19T11:13:32.237601129+08:00 stderr F I0719 11:13:32.237568       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_tcp_timeout_established' to 86400
2022-07-19T11:13:32.237638594+08:00 stderr F I0719 11:13:32.237613       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_tcp_timeout_close_wait' to 300
2022-07-19T11:13:32.237787689+08:00 stderr F I0719 11:13:32.237756       1 config.go:315] Starting service config controller

Any body know why the stream of log file is always stderr?

i expect that info messages is writing to stdout and err messages is writing to stderr.

STDOUT is usually a command’s normal output, and STDERR is typically used to output error messages. By default, docker/container logs show the command’s STDOUT and STDERR. This information that is logged and the format of the log depends almost entirely on the container’s endpoint command. When you use docker/ container as CRI to write the logs in Json it shows the default as STDERR and this needs to be parsed before moving to the logging agent.

Refer to this GIT LINK by stevenAcoffman for more information and here they used fluentbit as log parser.

You can also use sematext as a Log agent which supports CRI-O log format as well and install its Plugin to parse the logs.

> By default, Docker captures the standard output (and standard error)
> of all your containers, and writes them in files using the JSON
> format. The JSON format annotates each line with its origin (stdout or
> stderr) and its timestamp. Each log file contains information about
> only one container. {"log":"Log line is here\n","stream":"stdout","time":"2019-01-01T11:11:11.111111111Z"}

Along with the above, you need to install JSON Logging file driver