Fluentd: Update kernel and auth inputs to use systemd
This updates the overrides provided for deploying fluentd as a daemonset to get kernel messages from the journal instead of /var/log/kern.log directly, and also uses the journal to get messages associated with logging to auth.log (syslog facility 10). This provides additional metadata and a cleaner interface for gathering these logs via fluentd Change-Id: I8e832db276095771d6a869e998d7a69795dfee37 Signed-off-by: Steve Wilkerson <sw5822@att.com>
This commit is contained in:
parent
cc399a08ed
commit
781e65ac5d
@ -90,23 +90,16 @@ conf:
|
||||
</source>
|
||||
|
||||
<source>
|
||||
@type tail
|
||||
tag kernel
|
||||
path /var/log/kern.log
|
||||
read_from_head true
|
||||
<parse>
|
||||
@type none
|
||||
</parse>
|
||||
</source>
|
||||
|
||||
<source>
|
||||
@type tail
|
||||
@type systemd
|
||||
tag auth
|
||||
path /var/log/auth.log
|
||||
path /var/log/journal
|
||||
matches [{ "SYSLOG_FACILITY":"10" }]
|
||||
read_from_head true
|
||||
<parse>
|
||||
@type none
|
||||
</parse>
|
||||
|
||||
<entry>
|
||||
fields_strip_underscores true
|
||||
fields_lowercase true
|
||||
</entry>
|
||||
</source>
|
||||
|
||||
<source>
|
||||
@ -135,6 +128,19 @@ conf:
|
||||
</entry>
|
||||
</source>
|
||||
|
||||
<source>
|
||||
@type systemd
|
||||
tag kernel
|
||||
path /var/log/journal
|
||||
matches [{ "_TRANSPORT": "kernel" }]
|
||||
read_from_head true
|
||||
|
||||
<entry>
|
||||
fields_strip_underscores true
|
||||
fields_lowercase true
|
||||
</entry>
|
||||
</source>
|
||||
|
||||
<filter kubernetes.**>
|
||||
@type kubernetes_metadata
|
||||
</filter>
|
||||
@ -155,22 +161,6 @@ conf:
|
||||
</record>
|
||||
</filter>
|
||||
|
||||
<filter kernel>
|
||||
@type record_transformer
|
||||
<record>
|
||||
hostname "#{ENV['NODE_NAME']}"
|
||||
fluentd_pod "#{ENV['POD_NAME']}"
|
||||
</record>
|
||||
</filter>
|
||||
|
||||
<filter auth>
|
||||
@type record_transformer
|
||||
<record>
|
||||
hostname "#{ENV['NODE_NAME']}"
|
||||
fluentd_pod "#{ENV['POD_NAME']}"
|
||||
</record>
|
||||
</filter>
|
||||
|
||||
<match fluent.**>
|
||||
@type null
|
||||
</match>
|
||||
|
Loading…
Reference in New Issue
Block a user