[TOC] ## 指令清单 1. source:设置输入源 2. match:输出目的地 3. filter:事件处理管道 4. system: 系统范围的配置 5. label:对内部路由的输出和过滤器进行分组 6. @include:包括其他文件 ### source 实例:接受输入源 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command <source> @type forward port 24224 </source> # http://<ip>:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> ``` **路由** 事件由三个实体组成:tag, time, record - tag: 必须是字符串 - time:必须是Unix time format - record:必须是json格式的 ``` # generated by http://<ip>:9880/myapp.access?json={"event":"data"} tag: myapp.access time: (current time) record: {"event":"data"} ``` ### match Match 指令最常见的用途是将事件输出到其他系统 实例 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command <source> @type forward port 24224 </source> # http://<ip>:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> # Match events tagged with "myapp.access" and # store them to /var/log/fluent/access.%Y-%m-%d # Of course, you can control how you partition your data # with the time_slice_format option. # 文件格式为 /var/log/fluent/access.%Y-%m-%d <match myapp.access> @type file path /var/log/fluent/access </match> ``` ### filter 事件处理管道 ``` Input -> filter 1 -> ... -> filter N -> Output ``` 实例 ``` # http://this.host:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> <filter myapp.access> @type record_transformer <record> host_param "#{Socket.gethostname}" </record> </filter> <match myapp.access> @type file path /var/log/fluent/access </match> ``` ### system 设置系统范围的配置 实例 ``` <system> # equal to -qq option log_level error # equal to --without-source option without_source # ... </system> ``` 实例:修改 fluent 的进程名 ``` <system> process_name fluentd1 </system> ``` 查看: ``` > ps aux | grep fluentd1 foo 45673 0.4 0.2 2523252 38620 s001 S+ 7:04AM 0:00.44 worker:fluentd1 foo 45647 0.0 0.1 2481260 23700 s001 S+ 7:04AM 0:00.40 supervisor:fluentd1 ``` ### label 组筛选器和输出 ``` <source> @type forward </source> <source> @type tail @label @SYSTEM </source> <filter access.**> @type record_transformer <record> # ... </record> </filter> <match **> @type elasticsearch # ... </match> <label @SYSTEM> <filter var.log.middleware.**> @type grep # ... </filter> <match **> @type s3 # ... </match> </label> ``` ### @include - 可以使用@include 指令导入单独配置文件中的指令 - 指令支持常规文件路径、 glob 模式和 http URL 约定 实例: ``` # Include config files in the ./config.d directory @include config.d/*.conf ``` 实例:共享相同的参数 ``` # config file <match pattern> @type forward # ... <buffer> @type file path /path/to/buffer/forward @include /path/to/out_buf_params.conf </buffer> </match> <match pattern> @type elasticsearch # ... <buffer> @type file path /path/to/buffer/es @include /path/to/out_buf_params.conf </buffer> </match> # /path/to/out_buf_params.conf flush_interval 5s total_limit_size 100m chunk_limit_size 1m ```