Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
EKS on Fargate Datadog and Fluentbit sidecars example
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: testapp
name: testapp
spec:
replicas: 1
selector:
matchLabels:
app: testapp
strategy: {}
template:
metadata:
labels:
app: testapp
spec:
containers:
- image: alpine:3.10
name: alpine
command:
- /bin/sh
- -c
- sleep 100000
volumeMounts:
- name: fluent-bit-config
mountPath: /fluent-bit/etc/
- name: var-log
mountPath: /var/log
- image: fluent/fluent-bit:1.3.3
name: fluent-bit
volumeMounts:
- name: fluent-bit-config
mountPath: /fluent-bit/etc/
- name: var-log
mountPath: /var/log
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- image: datadog/agent:latest
name: datadog-test
env:
- name: DD_API_KEY
value: <YOUR DATADOG KEY>
volumes:
- name: fluent-bit-config
configMap:
name: fluent-bit-config
- name: var-log
emptyDir: {}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit-config
labels:
k8s-app: fluent-bit
data:
fluent-bit.conf: |
[SERVICE]
Flush 1
Log_Level info
Daemon off
Parsers_File parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
@INCLUDE input-json-log.conf
@INCLUDE filter-modifier.conf
@INCLUDE output-datadog.conf
input-json-log.conf: |
[INPUT]
Name tail
Tag log.json.*
Path /var/log/*.json.log
Parser json
DB /var/log/flb_json_log.db
Mem_Buf_Limit 5MB
Skip_Long_Lines On
Refresh_Interval 10
filter-modifier.conf: |
[FILTER]
Name record_modifier
Match *
Record hostname ${HOSTNAME}
Record kube_pod ${POD_NAME}
Record kube_namespace ${POD_NAMESPACE}
output-datadog.conf: |
[OUTPUT]
Name datadog
Match *
apikey <YOUR DATADOG KEY>
parsers.conf: |
[PARSER]
Name apache
Format regex
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
Time_Key time
Time_Format %d/%b/%Y:%H:%M:%S %z
[PARSER]
Name apache2
Format regex
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
Time_Key time
Time_Format %d/%b/%Y:%H:%M:%S %z
[PARSER]
Name apache_error
Format regex
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
[PARSER]
Name nginx
Format regex
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
Time_Key time
Time_Format %d/%b/%Y:%H:%M:%S %z
[PARSER]
Name json
Format json
Time_Key time
Time_Format %d/%b/%Y:%H:%M:%S %z
[PARSER]
Name docker
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
Time_Keep On
[PARSER]
Name syslog
Format regex
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
Time_Key time
Time_Format %b %d %H:%M:%S
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.