Major changes
This commit is contained in:
@@ -0,0 +1,273 @@
|
||||
[SERVICE]
|
||||
Flush 1
|
||||
Daemon Off
|
||||
Log_Level info
|
||||
Parsers_File parsers.conf
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Tag ingress.*
|
||||
Path /var/log/containers/nginx-ingress-microk8s-controller-*.log
|
||||
Parser cri
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Tag nextcloud.*
|
||||
Path /var/log/containers/nextcloud-app-*.log
|
||||
Parser cri
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Tag wordpress.*
|
||||
Path /var/log/containers/wordpress-app-*.log
|
||||
Parser cri
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Tag gitea.*
|
||||
Path /var/log/containers/gitea-app-*.log
|
||||
Parser cri
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Tag kube.*
|
||||
Path /var/log/containers/*.log
|
||||
Parser cri
|
||||
Refresh_Interval 5
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match ingress.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Kube_Tag_Prefix ingress.var.log.containers.
|
||||
Merge_Log On
|
||||
Merge_Log_Key log_processed
|
||||
Labels On
|
||||
K8S-Logging.Parser Off
|
||||
K8S-Logging.Exclude Off
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match nextcloud.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Kube_Tag_Prefix nextcloud.var.log.containers.
|
||||
Merge_Log On
|
||||
Merge_Log_Key log_processed
|
||||
Labels On
|
||||
K8S-Logging.Parser Off
|
||||
K8S-Logging.Exclude Off
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match wordpress.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Kube_Tag_Prefix wordpress.var.log.containers.
|
||||
Merge_Log On
|
||||
Merge_Log_Key log_processed
|
||||
Labels On
|
||||
K8S-Logging.Parser Off
|
||||
K8S-Logging.Exclude Off
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match gitea.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Kube_Tag_Prefix gitea.var.log.containers.
|
||||
Merge_Log On
|
||||
Merge_Log_Key log_processed
|
||||
Labels On
|
||||
K8S-Logging.Parser Off
|
||||
K8S-Logging.Exclude Off
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match kube.*
|
||||
Kube_URL https://kubernetes.default.svc:443
|
||||
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
Merge_Log On
|
||||
Merge_Log_Key log_processed
|
||||
Labels On
|
||||
K8S-Logging.Parser On
|
||||
K8S-Logging.Exclude On
|
||||
|
||||
[FILTER]
|
||||
Name nest
|
||||
Match *
|
||||
Wildcard pod_name
|
||||
Operation lift
|
||||
Nested_under kubernetes
|
||||
Add_prefix kubernetes_
|
||||
|
||||
[FILTER]
|
||||
Name rewrite_tag
|
||||
Match ingress.*
|
||||
Rule $kubernetes_pod_name ^.*$ ingress_logs false
|
||||
|
||||
[FILTER]
|
||||
Name rewrite_tag
|
||||
Match nextcloud.*
|
||||
Rule $kubernetes_pod_name ^.*$ nextcloud_logs false
|
||||
|
||||
[FILTER]
|
||||
Name rewrite_tag
|
||||
Match wordpress.*
|
||||
Rule $kubernetes_pod_name ^.*$ wordpress_logs false
|
||||
|
||||
[FILTER]
|
||||
Name rewrite_tag
|
||||
Match gitea.*
|
||||
Rule $kubernetes_pod_name ^.*$ gitea_logs false
|
||||
|
||||
[FILTER]
|
||||
Name rewrite_tag
|
||||
Match kube.*
|
||||
Rule $kubernetes_pod_name ^.*$ kubernetes_logs false
|
||||
|
||||
[FILTER]
|
||||
Name parser
|
||||
Match ingress_logs
|
||||
Key_Name log
|
||||
Parser nginx-ingress
|
||||
|
||||
[FILTER]
|
||||
Name parser
|
||||
Match nextcloud_logs
|
||||
Key_Name log
|
||||
Parser apache2
|
||||
|
||||
[FILTER]
|
||||
Name parser
|
||||
Match wordpress_logs
|
||||
Key_Name log
|
||||
Parser apache2
|
||||
|
||||
[FILTER]
|
||||
Name parser
|
||||
Match gitea_logs
|
||||
Key_Name log
|
||||
Parser gitea
|
||||
|
||||
[FILTER]
|
||||
Name geoip2
|
||||
Match ingress_logs
|
||||
Database /fluent-bit/etc/GeoLite2-City.mmdb
|
||||
Lookup_key host
|
||||
Record country_name host %{country.names.en}
|
||||
Record country_code host %{country.iso_code}
|
||||
Record city host %{city.names.en}
|
||||
Record coord.lat host %{location.latitude}
|
||||
Record coord.lon host %{location.longitude}
|
||||
|
||||
[FILTER]
|
||||
Name geoip2
|
||||
Match nextcloud_logs
|
||||
Database /fluent-bit/etc/GeoLite2-City.mmdb
|
||||
Lookup_key host
|
||||
Record country_name host %{country.names.en}
|
||||
Record country_code host %{country.iso_code}
|
||||
Record city host %{city.names.en}
|
||||
Record coord.lat host %{location.latitude}
|
||||
Record coord.lon host %{location.longitude}
|
||||
|
||||
[FILTER]
|
||||
Name geoip2
|
||||
Match wordpress_logs
|
||||
Database /fluent-bit/etc/GeoLite2-City.mmdb
|
||||
Lookup_key host
|
||||
Record country_name host %{country.names.en}
|
||||
Record country_code host %{country.iso_code}
|
||||
Record city host %{city.names.en}
|
||||
Record coord.lat host %{location.latitude}
|
||||
Record coord.lon host %{location.longitude}
|
||||
|
||||
[FILTER]
|
||||
Name nest
|
||||
Match ingress_logs
|
||||
Operation nest
|
||||
Wildcard coord.*
|
||||
Nested_under coordinates
|
||||
Remove_prefix coord.
|
||||
|
||||
[FILTER]
|
||||
Name nest
|
||||
Match nextcloud_logs
|
||||
Operation nest
|
||||
Wildcard coord.*
|
||||
Nested_under coordinates
|
||||
Remove_prefix coord.
|
||||
|
||||
[FILTER]
|
||||
Name nest
|
||||
Match wordpress_logs
|
||||
Operation nest
|
||||
Wildcard coord.*
|
||||
Nested_under coordinates
|
||||
Remove_prefix coord.
|
||||
|
||||
[OUTPUT]
|
||||
Name influxdb
|
||||
Match ingress_logs
|
||||
Host influxdb
|
||||
Port 8086
|
||||
Database ingress
|
||||
Sequence_Tag off
|
||||
Tag_Keys proxy_upstream_name code
|
||||
|
||||
[OUTPUT]
|
||||
Name influxdb
|
||||
Match nextcloud_logs
|
||||
Host influxdb
|
||||
Port 8086
|
||||
Database nextcloud
|
||||
Sequence_Tag off
|
||||
Tag_Keys code
|
||||
|
||||
[OUTPUT]
|
||||
Name influxdb
|
||||
Match wordpress_logs
|
||||
Host influxdb
|
||||
Port 8086
|
||||
Database wordpress
|
||||
Sequence_Tag off
|
||||
Tag_Keys code
|
||||
|
||||
[OUTPUT]
|
||||
Name influxdb
|
||||
Match gitea_logs
|
||||
Host influxdb
|
||||
Port 8086
|
||||
Database gitea
|
||||
Sequence_Tag off
|
||||
Tag_Keys status_code
|
||||
|
||||
[OUTPUT]
|
||||
Name influxdb
|
||||
Match kubernetes_logs
|
||||
Host influxdb
|
||||
Port 8086
|
||||
Database kubernetes
|
||||
Sequence_Tag off
|
||||
Tag_Keys kubernetes_namespace_name kubernetes_container_name
|
||||
@@ -0,0 +1,68 @@
|
||||
[PARSER]
|
||||
Name apache
|
||||
Format regex
|
||||
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
||||
Time_Key time
|
||||
Time_Format %d/%b/%Y:%H:%M:%S %z
|
||||
|
||||
[PARSER]
|
||||
Name apache2
|
||||
Format regex
|
||||
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
||||
Time_Key time
|
||||
Time_Format %d/%b/%Y:%H:%M:%S %z
|
||||
|
||||
[PARSER]
|
||||
Name apache_error
|
||||
Format regex
|
||||
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
|
||||
|
||||
[PARSER]
|
||||
Name nginx
|
||||
Format regex
|
||||
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
|
||||
Time_Key time
|
||||
Time_Format %d/%b/%Y:%H:%M:%S %z
|
||||
|
||||
[PARSER]
|
||||
Name json
|
||||
Format json
|
||||
Time_Key time
|
||||
Time_Format %d/%b/%Y:%H:%M:%S %z
|
||||
|
||||
[PARSER]
|
||||
Name docker
|
||||
Format json
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
||||
Time_Keep On
|
||||
|
||||
[PARSER]
|
||||
# https://rubular.com/r/V3W1DWyv5uFCfh
|
||||
Name nginx-ingress
|
||||
Format regex
|
||||
Regex ^(?<host>[^ ]*) - (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*) "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<request_length>[^ ]*) (?<request_time>[^ ]*) \[(?<proxy_upstream_name>[^ ]*)\] (\[(?<proxy_alternative_upstream_name>[^ ]*)\] )?(?<upstream_addr>[^ ]*) (?<upstream_response_length>[^ ]*) (?<upstream_response_time>[^ ]*) (?<upstream_status>[^ ]*) (?<reg_id>[^ ]*).*$
|
||||
Time_Key time
|
||||
Time_Format %d/%b/%Y:%H:%M:%S %z
|
||||
|
||||
[PARSER]
|
||||
Name gitea
|
||||
Format regex
|
||||
Regex ^(?<time>[^ ]\d+\/\d+\/\d+ \d+:\d+:\d+) (((?<model_func>.*) \[I\])? \[[0-9a-z-]+\] (\[SQL\] (?<query>.*) - (?<query_time>[0-9.]+)µs|(?<message>.*))|\[[0-9a-z-]+\] router: (?<state>\w+) (?<method>\S+) (?<path>.*?) for (?<src>[^ ]*):(?<src_port>[^ ]*), (?<status_code>[^ ]*) (?<status_msg>[^ ]*) in (?<exec_time>[0-9.]+)ms @ (?<func>.*).*)
|
||||
Time_Key time
|
||||
Time_Format %Y/%m/%d %H:%M:%S
|
||||
|
||||
[PARSER]
|
||||
Name cri
|
||||
Format regex
|
||||
# XXX: modified from upstream: s/message/log/
|
||||
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
||||
|
||||
[PARSER]
|
||||
Name catchall
|
||||
Format regex
|
||||
Regex ^(?<message>.*)$
|
||||
|
||||
|
||||
Reference in New Issue
Block a user