Docs/ELK/fluent收集不同ns的日志.md

67 lines
No EOL
2.2 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

```yaml
# 区分收集csc,erp,oms等不同命名空间的日志
# 区分收集的原因为同一个index中字段数据不同会导致冲突若无冲突可以一起收集
output.conf: |-
# <match **> ## 收集所有日志
# <match kubernetes.var.**_csc_** kubernetes.var.**_erp_** kubernetes.var.**_oms_** kubernetes.var.**_platform_** kubernetes.var.**_srm_**> ## 收集确定的命名空间服务中的日志
<match kubernetes.var.**_csc_**> ## 收集csc命名空间日志
@id elasticsearch-csc ## 与其他配置不同
@type elasticsearch
@log_level info
type_name _doc
include_tag_key true
host elasticsearch-headless
port 9200
logstash_format true ## logstash格式化index名称默认以logstash开头的index
logstash_prefix csc ## logstash_format开启以后设置index名称则index为csc-yyyy.MM.dd
request_timeout 15s
reload_connections false
reconnect_on_error true
reload_on_failure true
suppress_type_name true
<buffer>
@type file
path /var/log/fluentd-buffers/kubernetes.system.csc.buffer ## 与其他配置不同
flush_mode interval
flush_thread_count 2
flush_interval 5s
retry_type exponential_backoff
retry_forever
retry_max_interval 30
chunk_limit_size 10M
queue_limit_length 1
total_limit_size 500M
overflow_action block
</buffer>
</match>
<match **>
@id elasticsearch
@type elasticsearch
@log_level info
type_name _doc
include_tag_key true
host elasticsearch-headless
port 9200
logstash_format true
request_timeout 15s
reload_connections false
reconnect_on_error true
reload_on_failure true
suppress_type_name true
<buffer>
@type file
path /var/log/fluentd-buffers/kubernetes.system.buffer
flush_mode interval
flush_thread_count 2
flush_interval 5s
retry_type exponential_backoff
retry_forever
retry_max_interval 30
chunk_limit_size 10M
queue_limit_length 1
total_limit_size 500M
overflow_action block
</buffer>
</match>
```