Created
January 20, 2023 10:14
-
-
Save Cpriyanshi77/80ac75258dfc09ff3fd7ff505c70b6c1 to your computer and use it in GitHub Desktop.
Fluent-bit ConfigMap
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: v1 | |
kind: ConfigMap | |
metadata: | |
name: fluent-bit-config | |
namespace: kube-logging | |
labels: | |
k8s-app: f-bit-pod | |
data: | |
# Configuration files: server, input, filters and output | |
# ====================================================== | |
fluent-bit.conf: | | |
[SERVICE] | |
Flush 1 | |
Log_Level info | |
Daemon off | |
Parsers_File parsers.conf | |
HTTP_Server On | |
HTTP_Listen 0.0.0.0 | |
HTTP_Port 2020 | |
@INCLUDE input-kubernetes.conf | |
@INCLUDE filter-kubernetes.conf | |
@INCLUDE output-elasticsearch.conf | |
input-kubernetes.conf: | | |
[INPUT] | |
Name tail | |
Tag kube.* | |
Path /var/log/containers/*.log | |
Parser docker | |
DB /var/log/flb_kube.db | |
Mem_Buf_Limit 5MB | |
Skip_Long_Lines On | |
Refresh_Interval 10 | |
filter-kubernetes.conf: | | |
[FILTER] | |
Name kubernetes | |
Match kube.* | |
Kube_URL https://kubernetes.default.svc:443 | |
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token | |
Kube_Tag_Prefix kube.var.log.containers.* | |
Merge_Log On | |
Merge_Log_Key log_processed | |
K8S-Logging.Parser On | |
K8S-Logging.Exclude Off | |
output-elasticsearch.conf: | | |
[OUTPUT] | |
Name es | |
Match * | |
Host ${FLUENT_ELASTICSEARCH_HOST} | |
Port ${FLUENT_ELASTICSEARCH_PORT} | |
HTTP_User ${FLUENT_ELASTICSEARCH_USER} | |
HTTP_Passwd ${FLUENT_ELASTICSEARCH_PASSWORD} | |
Logstash_Format On | |
Replace_Dots On | |
Retry_Limit False | |
parsers.conf: | | |
[PARSER] | |
Name apache | |
Format regex | |
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name apache2 | |
Format regex | |
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name apache_error | |
Format regex | |
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$ | |
[PARSER] | |
Name nginx | |
Format regex | |
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name json | |
Format json | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name docker | |
Format json | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L | |
Time_Keep On | |
[PARSER] | |
Name syslog | |
Format regex | |
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$ | |
Time_Key time | |
Time_Format %b %d %H:%M:%S |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment