语法

[TOC] ## 指令清单 1. source:设置输入源 2. match:输出目的地 3. filter:事件处理管道 4. system: 系统范围的配置 5. label:对内部路由的输出和过滤器进行分组 6. @include:包括其他文件 ### source 实例:接受输入源 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command @type forward port 24224 # http://:9880/myapp.access?json={"event":"data"} @type http port 9880 ``` **路由** 事件由三个实体组成:tag, time, record - tag: 必须是字符串 - time:必须是Unix time format - record:必须是json格式的 ``` # generated by http://:9880/myapp.access?json={"event":"data"} tag: myapp.access time: (current time) record: {"event":"data"} ``` ### match Match 指令最常见的用途是将事件输出到其他系统 实例 ``` # Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command @type forward port 24224 # http://:9880/myapp.access?json={"event":"data"} @type http port 9880 # Match events tagged with "myapp.access" and # store them to /var/log/fluent/access.%Y-%m-%d # Of course, you can control how you partition your data # with the time_slice_format option. # 文件格式为 /var/log/fluent/access.%Y-%m-%d @type file path /var/log/fluent/access ``` ### filter 事件处理管道 ``` Input -> filter 1 -> ... -> filter N -> Output ``` 实例 ``` # http://this.host:9880/myapp.access?json={"event":"data"} @type http port 9880 @type record_transformer host_param "#{Socket.gethostname}" @type file path /var/log/fluent/access ``` ### system 设置系统范围的配置 实例 ``` # equal to -qq option log_level error # equal to --without-source option without_source # ... ``` 实例:修改 fluent 的进程名 ``` process_name fluentd1 ``` 查看: ``` > ps aux | grep fluentd1 foo 45673 0.4 0.2 2523252 38620 s001 S+ 7:04AM 0:00.44 worker:fluentd1 foo 45647 0.0 0.1 2481260 23700 s001 S+ 7:04AM 0:00.40 supervisor:fluentd1 ``` ### label 组筛选器和输出 ``` @type forward @type tail @label @SYSTEM @type record_transformer # ... @type elasticsearch # ... @type grep # ... @type s3 # ... ``` ### @include - 可以使用@include 指令导入单独配置文件中的指令 - 指令支持常规文件路径、 glob 模式和 http URL 约定 实例: ``` # Include config files in the ./config.d directory @include config.d/*.conf ``` 实例:共享相同的参数 ``` # config file @type forward # ... @type file path /path/to/buffer/forward @include /path/to/out_buf_params.conf @type elasticsearch # ... @type file path /path/to/buffer/es @include /path/to/out_buf_params.conf # /path/to/out_buf_params.conf flush_interval 5s total_limit_size 100m chunk_limit_size 1m ```