fluentd mail-mongodb setting

log-td-agent.conf

# logサーバ用の設定
<source>
  type forward
  port 24224
</source>

<match maillog>
  type mongo
  database mail
  collection log
  host 127.0.0.1
  port 27017
  flush_interval 10s
</match>

mail-td-agent.conf

# mailサーバ用の設定
<source>
  type tail
  path /var/log/maillog
  tag maillog
  format /^(?<date>[^ ]+) (?<host>[^ ]+) (?<process>[^:]+): (?<message>((?<key>[^ :]+)[ :])? ?((to|from)=<(?<address>[^>]+)>)?.*)$/
  pos_file /var/log/td-agent/mail.pos
</source>

<match maillog>
  type forward
  <server>
    host 192.168.xxx.xxx
  </server>
</match>

maillog_chmod.sh

sudo chmod 644 /var/log/maillog

rsyslog.conf.diff

--- /etc/rsyslog.conf.dist	2012-05-21 14:56:26.993633192 +0900
+++ /etc/rsyslog.conf	2012-05-21 14:57:41.900632519 +0900
@@ -21,7 +21,7 @@
 #### GLOBAL DIRECTIVES ####
 
 # Use default timestamp format
-$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+$ActionFileDefaultTemplate RSYSLOG_FileFormat
 
 # File syncing capability is disabled by default. This feature is usually not required, 
 # not useful and an extreme performance hit

td-agent.conf

# mail,logを1台で動かす場合
<source>
  type tail
  path /var/log/maillog
  tag maillog
  format /^(?<date>[^ ]+) (?<host>[^ ]+) (?<process>[^:]+): (?<message>((?<key>[^ :]+)[ :])? ?((to|from)=<(?<address>[^>]+)>)?.*)$/
  pos_file /var/log/td-agent/mail.pos
</source>

<match maillog>
  type file
  path /var/log/td-agent/mail_log
</match>