流程示例:
本文介绍典型的流程示例。
Simple Input -> Filter -> Output
<source> @type forward </source> <filter app.**> @type record_transformer <record> hostname "#{Socket.gethostname}" </record> </filter> <match app.**> @type file # ... </match>
Two input cases
<source> @type forward </source> <source> @type tail tag system.logs # ... </source> <filter app.**> @type record_transformer <record> hostname "#{Socket.gethostname}" </record> </filter> <match {app.**,system.logs}> @type file # ... </match>
如果要为每个源(source)分隔数据流水线,请使用Label。
Input -> Filter -> Output with Label
标签(label)通过分离数据流水线来减少复杂的tag处理
<source> @type forward </source> <source> @type dstat @label @METRICS # dstat events are routed to <label @METRICS> # ... </source> <filter app.**> @type record_transformer <record> # ... </record> </filter> <match app.**> @type file # ... </match> <label @METRICS> <match **> @type elasticsearch # ... </match> </label>
Re-route event by tag
使用Fluent-plugin-route。流程插件改写标签(tag)和重新发出事件的其match或tag。
<match worker.**> @type route remove_tag_prefix worker add_tag_prefix metrics.event <route **> copy # For fall-through. Without copy, routing is stopped here. </route> <route **> copy @label @BACKUP </route> </match> <match metrics.event.**> @type stdout </match> <label @BACKUP> <match metrics.event.**> @type file path /var/log/fluent/bakcup </match> </label>
Re-route event by record content
通过记录内容重新路由事件
使用这个 fluent-plugin-rewrite-tag-filter.
<source> @type forward </source> # event example: app.logs {"message":"[info]: ..."} <match app.**> @type rewrite_tag_filter rewriterule1 message ^\[(\w+)\] $1.${tag} </match> # send mail when receives alert level logs <match alert.app.**> @type mail # ... </match> # other logs are stored into file <match *.app.**> @type file # ... </match>
另请参见out_rewrite_tag_filter文章。
Re-route event to other Label
使用out_relabel插件。 relabel插件只是将事件发送到Label。 没有tag重写。
<source> @type forward </source> <match app.**> @type copy <store> @type forward # ... </store> <store> @type relabel @label @NOTIFICATION </store> </match> <label @NOTIFICATION> <filter app.**> @type grep regexp1 message ERROR </filter> <match app.**> @type mail </match> </label>