fluent-bit

ماذا يفعل

طريقة الكتابة

fluent-bit -c CONFIG
fluent-bit -i INPUT -o OUTPUT [-p key=value]

الأجزاء الرئيسية

Pipeline parts

[INPUT] tail

Read log files (with position database).

[INPUT] systemd

Read the journal.

[FILTER] kubernetes

Add pod, namespace and labels.

[FILTER] grep

Keep or drop records by regex.

[FILTER] modify / record_modifier

Add, rename, remove fields.

[OUTPUT] loki

Send to Loki.

[OUTPUT] es

Send to Elasticsearch/OpenSearch.

[OUTPUT] azure_logs_ingestion

Send to Azure Monitor (DCR).

[OUTPUT] stdout

Print (debugging).

الأكثر استخدامًا

لا يوجد شيء يطابق هذا الفلتر.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1. 1Test quickly on the terminal

   $fluent-bit -i cpu -o stdout -f 1
   $fluent-bit -i systemd -p systemd_filter=_SYSTEMD_UNIT=sshd.service -o stdout

2. 2Ship nginx logs to Loki

   #cat /etc/fluent-bit/fluent-bit.conf
   [SERVICE]
       Flush        5
       HTTP_Server  On
   [INPUT]
       Name   tail
       Path   /var/log/nginx/access.log
       Tag    nginx.access
       DB     /var/lib/fluent-bit/nginx.db
   [OUTPUT]
       Name   loki
       Match  nginx.*
       Host   loki.lab.local
       Port   3100
       Labels job=nginx, host=${HOSTNAME}

3. 3Check the config

   #fluent-bit -c /etc/fluent-bit/fluent-bit.conf --dry-run
   #systemctl restart fluent-bit

4. 4Read the journal and drop debug lines

   #cat /etc/fluent-bit/journal.conf
   [INPUT]
       Name            systemd
       Tag             host.*
       Read_From_Tail  On
   [FILTER]
       Name    grep
       Match   host.*
       Exclude PRIORITY ^7$

5. 5Hide secrets before sending

   #cat /etc/fluent-bit/mask.conf
   [FILTER]
       Name   modify
       Match  *
       Remove password
       Remove authorization

6. 6Install on Kubernetes with Helm

   $helm repo add fluent https://fluent.github.io/helm-charts
   $helm install fluent-bit fluent/fluent-bit -n logging --create-namespace -f fluent-bit-values.yaml
   $kubectl -n logging get ds fluent-bit

7. 7Add Kubernetes metadata

   $cat fluent-bit-values.yaml
   config:
     filters: |
       [FILTER]
           Name       kubernetes
           Match      kube.*
           Merge_Log  On
           Keep_Log   Off

8. 8Watch its own health

   $curl -s http://localhost:2020/api/v1/metrics | jq '.output'
   $curl -s http://localhost:2020/api/v1/health

9. 9Read its logs

   #journalctl -u fluent-bit -f

10. 10Send to Azure Monitor Logs

    #cat /etc/fluent-bit/azure.conf
    [OUTPUT]
        Name            azure_logs_ingestion
        Match           *
        client_id       ${AZ_CLIENT_ID}
        client_secret   ${AZ_CLIENT_SECRET}
        tenant_id       ${AZ_TENANT_ID}
        dce_url         https://dce-lab-weu.westeurope-1.ingest.monitor.azure.com
        dcr_id          dcr-00000000000000000000000000000000
        table_name      Syslog_CL

لا يوجد شيء يطابق هذا الفلتر.

الملفات

/etc/fluent-bit/fluent-bit.conf

Main config.

/etc/fluent-bit/parsers.conf

Parsers (json, regex, docker, cri).

رموز الخروج