Shulou(Shulou.com)06/01 Report--

This article mainly shows you the "sample Analysis of Fluentd routing", which is easy to understand and clear. I hope it can help you solve your doubts. Let the editor lead you to study and learn the article "sample Analysis of Fluentd routing".

Simple scenario: single input-> filter-> output

@ type forward

@ type record_transformer hostname "# {Socket.gethostname}"

@ type file #...

Forward receives tcp messages, and record_transformer adds a hostname field to the log, which is output to file

Two inputs

@ type forward

@ type tail tag system.logs #...

@ type record_transformer hostname "# {Socket.gethostname}"

@ type file #...

Compared to the previous example, an tail input is added, and the events generated by tail are written directly to the file.

Input-> filter-> tagged output

@ type forward

@ type dstat @ label @ METRICS # dstat events are routed to #...

@ type record_transformer #...

@ type file #...

@ type elasticsearch #...

The event handling flow generated by forward remains unchanged. Dstat directly jumps to the label specified by @ METRICS and writes to elasticsearch.

Rewrite tag rerouting

@ type route remove_tag_prefix worker add_tag_prefix metrics.event

Copy # For fall-through. Without copy, routing is stopped here. Copy @ label @ BACKUP

@ type stdout

@ type file path / var/log/fluent/backup

The route plug-in re-marks the event marked by worker as metrics.event and resends the event to the routing engine, which enters two processing branches: output to stdout; and write to file

Rerouting based on record content

@ type forward

# event example: app.logs {"message": "[info]:..."} @ type rewrite_tag_filter key message pattern ^\ [(\ w+)\] tag $1.$ {tag} # you can put more

# send mail when receives alert level logs @ type mail #...

# other logs are stored into file @ type file #...

The events generated by forward are handled by rewrite_tag_filter, extract the [log_level] from the record, and generate a new tag before adding it to the original tag. Events enter the routing engine again. Events marked by tag at the beginning of alert are handled by mail. Other types of events are written to file.

Reroute to the specified label

@ type forward

@ type copy @ type forward #... @ type relabel @ label @ NOTIFICATION

@ type grep regexp1 message ERROR

@ type mail uses the relabel plug-in to route events directly to the label processing specified by @ NOTIFICATION. Relabel does not modify the tag of the event.

The above is all the contents of the article "sample Analysis of Fluentd routing". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.