|
Doc Text:
|
To send necessary information to the remote syslog, the following changes were made.
If setting the directive use_record to true (false, by default) in /etc/fluent/configs.d/dynamic/output-remote-syslog.conf,
1) hostname in the fluentd record is forwarded to the remote syslog. Otherwise, the hostname of the fluentd is forwarded.
2-1) application logs:
including "container_name", "namespace_name", and "pod_name" in the output content
facility - configured value in output-remote-syslog.conf is set.
'user' by default
severity - configured value in output-remote-syslog.conf is set.
'info' by default
2-2) operation logs:
facility - set record[systemd][u][SYSLOG_FACILITY] to facility if available
severity - set record[level] to severity if available
3) The directive tag_key improvement.
. tag_key takes multiple values.
e.g., tag_key ident,SYSLOG_IDENTIFIER
. tag_key takes the dot formatted nested tag key.
e.g., tag_key systemd.u.SYSLOG_IDENTIFIER
Notes: If the tag_key is not set, the fluentd tag ("output_ops_tag" for operation logs;
"output_tag" for container logs) is sent to rsyslog. When a tag_key is specified and
the value is found in the record key, the record value is used for the tag. E.g.,
tag_key ident
record['ident'] == "myTag"
then, "myTag" is set to tag in the packet to be sent to rsyslog.
If multiple tag_key values are configured, the first hit one is picked up and the rest
is ignored even if it's found in the record. E.g.,
tag_key systemd.u.SYSLOG_IDENTIFIER,ident
record['systemd']['u']['SYSLOG_IDENTIFIER'] == "myTag0"
record['ident'] == "myTag1"
then, "myTag0" is set to tag in the packet to be sent to rsyslog.
If none of tag_key value does not hit, it falls back to the default behaviour and
output_ops_tag for operation and output_tag for container logs are sent.
Sample logs in /var/log/messages when use_record is set to true.
Log test message by logger: rsyslogTestMessage-20180215-145124
3,17,Feb 15 14:52:25,ip-172-18-5-234.ec2.internal,rsyslogTestTag:, rsyslogTestMessage-20180215-145124
Log test message by kibana: testKibanaMessage-20180215-145225
6,16,Feb 15 14:52:41,ip-172-18-5-234.ec2.internal,output_tag:, namespace_name=logging, container_name=kibana, pod_name=logging-kibana-1-qr6pl, message=GET /testKibanaMessage-20180215-145225 404 4ms - 9.0B
|