[TOC] ## 指令清單 1. source:設置輸入源 2. match:輸出目的地 3. filter:事件處理管道 4. system: 系統范圍的配置 5. label:對內部路由的輸出和過濾器進行分組 6. @include:包括其他文件 ### source 實例:接受輸入源 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command <source> @type forward port 24224 </source> # http://<ip>:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> ``` **路由** 事件由三個實體組成:tag, time, record - tag: 必須是字符串 - time:必須是Unix time format - record:必須是json格式的 ``` # generated by http://<ip>:9880/myapp.access?json={"event":"data"} tag: myapp.access time: (current time) record: {"event":"data"} ``` ### match Match 指令最常見的用途是將事件輸出到其他系統 實例 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command <source> @type forward port 24224 </source> # http://<ip>:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> # Match events tagged with "myapp.access" and # store them to /var/log/fluent/access.%Y-%m-%d # Of course, you can control how you partition your data # with the time_slice_format option. # 文件格式為 /var/log/fluent/access.%Y-%m-%d <match myapp.access> @type file path /var/log/fluent/access </match> ``` ### filter 事件處理管道 ``` Input -> filter 1 -> ... -> filter N -> Output ``` 實例 ``` # http://this.host:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> <filter myapp.access> @type record_transformer <record> host_param "#{Socket.gethostname}" </record> </filter> <match myapp.access> @type file path /var/log/fluent/access </match> ``` ### system 設置系統范圍的配置 實例 ``` <system> # equal to -qq option log_level error # equal to --without-source option without_source # ... </system> ``` 實例:修改 fluent 的進程名 ``` <system> process_name fluentd1 </system> ``` 查看: ``` > ps aux | grep fluentd1 foo 45673 0.4 0.2 2523252 38620 s001 S+ 7:04AM 0:00.44 worker:fluentd1 foo 45647 0.0 0.1 2481260 23700 s001 S+ 7:04AM 0:00.40 supervisor:fluentd1 ``` ### label 組篩選器和輸出 ``` <source> @type forward </source> <source> @type tail @label @SYSTEM </source> <filter access.**> @type record_transformer <record> # ... </record> </filter> <match **> @type elasticsearch # ... </match> <label @SYSTEM> <filter var.log.middleware.**> @type grep # ... </filter> <match **> @type s3 # ... </match> </label> ``` ### @include - 可以使用@include 指令導入單獨配置文件中的指令 - 指令支持常規文件路徑、 glob 模式和 http URL 約定 實例: ``` # Include config files in the ./config.d directory @include config.d/*.conf ``` 實例:共享相同的參數 ``` # config file <match pattern> @type forward # ... <buffer> @type file path /path/to/buffer/forward @include /path/to/out_buf_params.conf </buffer> </match> <match pattern> @type elasticsearch # ... <buffer> @type file path /path/to/buffer/es @include /path/to/out_buf_params.conf </buffer> </match> # /path/to/out_buf_params.conf flush_interval 5s total_limit_size 100m chunk_limit_size 1m ```