Fluentd: Update kernel and auth inputs to use systemd

This updates the overrides provided for deploying fluentd as a
daemonset to get kernel messages from the journal instead of
/var/log/kern.log directly, and also uses the journal to get
messages associated with logging to auth.log (syslog facility
10). This provides additional metadata and
a cleaner interface for gathering these logs via fluentd

Change-Id: I8e832db276095771d6a869e998d7a69795dfee37
Signed-off-by: Steve Wilkerson <sw5822@att.com>
This commit is contained in:
Steve Wilkerson 2019-08-14 13:04:25 -05:00 committed by Steve Wilkerson
parent cc399a08ed
commit 781e65ac5d

View File

@ -90,23 +90,16 @@ conf:
</source>
<source>
@type tail
tag kernel
path /var/log/kern.log
read_from_head true
<parse>
@type none
</parse>
</source>
<source>
@type tail
@type systemd
tag auth
path /var/log/auth.log
path /var/log/journal
matches [{ "SYSLOG_FACILITY":"10" }]
read_from_head true
<parse>
@type none
</parse>
<entry>
fields_strip_underscores true
fields_lowercase true
</entry>
</source>
<source>
@ -135,6 +128,19 @@ conf:
</entry>
</source>
<source>
@type systemd
tag kernel
path /var/log/journal
matches [{ "_TRANSPORT": "kernel" }]
read_from_head true
<entry>
fields_strip_underscores true
fields_lowercase true
</entry>
</source>
<filter kubernetes.**>
@type kubernetes_metadata
</filter>
@ -155,22 +161,6 @@ conf:
</record>
</filter>
<filter kernel>
@type record_transformer
<record>
hostname "#{ENV['NODE_NAME']}"
fluentd_pod "#{ENV['POD_NAME']}"
</record>
</filter>
<filter auth>
@type record_transformer
<record>
hostname "#{ENV['NODE_NAME']}"
fluentd_pod "#{ENV['POD_NAME']}"
</record>
</filter>
<match fluent.**>
@type null
</match>