fluent-plugin-elasticsearch2 3.5.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.coveralls.yml +2 -0
- data/.editorconfig +9 -0
- data/.gitignore +18 -0
- data/.travis.yml +18 -0
- data/CONTRIBUTING.md +24 -0
- data/Gemfile +9 -0
- data/History.md +402 -0
- data/ISSUE_TEMPLATE.md +30 -0
- data/LICENSE.txt +201 -0
- data/PULL_REQUEST_TEMPLATE.md +10 -0
- data/README.md +1558 -0
- data/Rakefile +11 -0
- data/appveyor.yml +30 -0
- data/fluent-plugin-elasticsearch.gemspec +31 -0
- data/lib/fluent/log-ext.rb +38 -0
- data/lib/fluent/plugin/elasticsearch_constants.rb +13 -0
- data/lib/fluent/plugin/elasticsearch_error.rb +5 -0
- data/lib/fluent/plugin/elasticsearch_error_handler.rb +127 -0
- data/lib/fluent/plugin/elasticsearch_index_template.rb +112 -0
- data/lib/fluent/plugin/elasticsearch_simple_sniffer.rb +10 -0
- data/lib/fluent/plugin/filter_elasticsearch_genid.rb +25 -0
- data/lib/fluent/plugin/oj_serializer.rb +22 -0
- data/lib/fluent/plugin/out_elasticsearch.rb +782 -0
- data/lib/fluent/plugin/out_elasticsearch_dynamic.rb +262 -0
- data/test/helper.rb +24 -0
- data/test/plugin/test_alias_template.json +9 -0
- data/test/plugin/test_elasticsearch_error_handler.rb +525 -0
- data/test/plugin/test_filter_elasticsearch_genid.rb +44 -0
- data/test/plugin/test_out_elasticsearch.rb +2811 -0
- data/test/plugin/test_out_elasticsearch_dynamic.rb +1001 -0
- data/test/plugin/test_template.json +23 -0
- data/test/test_log-ext.rb +35 -0
- metadata +198 -0
data/ISSUE_TEMPLATE.md
ADDED
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
(check apply)
|
|
2
|
+
- [ ] read [the contribution guideline](https://github.com/uken/fluent-plugin-elasticsearch/blob/master/CONTRIBUTING.md)
|
|
3
|
+
|
|
4
|
+
#### Problem
|
|
5
|
+
|
|
6
|
+
...
|
|
7
|
+
|
|
8
|
+
#### Steps to replicate
|
|
9
|
+
|
|
10
|
+
Either clone and modify https://gist.github.com/pitr/9a518e840db58f435911
|
|
11
|
+
|
|
12
|
+
**OR**
|
|
13
|
+
|
|
14
|
+
Provide example config and message
|
|
15
|
+
|
|
16
|
+
#### Expected Behavior or What you need to ask
|
|
17
|
+
|
|
18
|
+
...
|
|
19
|
+
|
|
20
|
+
#### Using Fluentd and ES plugin versions
|
|
21
|
+
|
|
22
|
+
* OS version
|
|
23
|
+
* Bare Metal or within Docker or Kubernetes or others?
|
|
24
|
+
* Fluentd v0.12 or v0.14/v1.0
|
|
25
|
+
* paste result of ``fluentd --version`` or ``td-agent --version``
|
|
26
|
+
* ES plugin 3.x.y/2.x.y or 1.x.y
|
|
27
|
+
* paste boot log of fluentd or td-agent
|
|
28
|
+
* paste result of ``fluent-gem list``, ``td-agent-gem list`` or your Gemfile.lock
|
|
29
|
+
* ES version (optional)
|
|
30
|
+
* ES template(s) (optional)
|
data/LICENSE.txt
ADDED
|
@@ -0,0 +1,201 @@
|
|
|
1
|
+
Apache License
|
|
2
|
+
Version 2.0, January 2004
|
|
3
|
+
http://www.apache.org/licenses/
|
|
4
|
+
|
|
5
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
6
|
+
|
|
7
|
+
1. Definitions.
|
|
8
|
+
|
|
9
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
10
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
11
|
+
|
|
12
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
13
|
+
the copyright owner that is granting the License.
|
|
14
|
+
|
|
15
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
16
|
+
other entities that control, are controlled by, or are under common
|
|
17
|
+
control with that entity. For the purposes of this definition,
|
|
18
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
19
|
+
direction or management of such entity, whether by contract or
|
|
20
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
21
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
22
|
+
|
|
23
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
24
|
+
exercising permissions granted by this License.
|
|
25
|
+
|
|
26
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
27
|
+
including but not limited to software source code, documentation
|
|
28
|
+
source, and configuration files.
|
|
29
|
+
|
|
30
|
+
"Object" form shall mean any form resulting from mechanical
|
|
31
|
+
transformation or translation of a Source form, including but
|
|
32
|
+
not limited to compiled object code, generated documentation,
|
|
33
|
+
and conversions to other media types.
|
|
34
|
+
|
|
35
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
36
|
+
Object form, made available under the License, as indicated by a
|
|
37
|
+
copyright notice that is included in or attached to the work
|
|
38
|
+
(an example is provided in the Appendix below).
|
|
39
|
+
|
|
40
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
41
|
+
form, that is based on (or derived from) the Work and for which the
|
|
42
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
43
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
44
|
+
of this License, Derivative Works shall not include works that remain
|
|
45
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
46
|
+
the Work and Derivative Works thereof.
|
|
47
|
+
|
|
48
|
+
"Contribution" shall mean any work of authorship, including
|
|
49
|
+
the original version of the Work and any modifications or additions
|
|
50
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
51
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
52
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
53
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
54
|
+
means any form of electronic, verbal, or written communication sent
|
|
55
|
+
to the Licensor or its representatives, including but not limited to
|
|
56
|
+
communication on electronic mailing lists, source code control systems,
|
|
57
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
58
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
59
|
+
excluding communication that is conspicuously marked or otherwise
|
|
60
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
61
|
+
|
|
62
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
63
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
64
|
+
subsequently incorporated within the Work.
|
|
65
|
+
|
|
66
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
67
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
68
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
69
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
70
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
71
|
+
Work and such Derivative Works in Source or Object form.
|
|
72
|
+
|
|
73
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
74
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
75
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
76
|
+
(except as stated in this section) patent license to make, have made,
|
|
77
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
78
|
+
where such license applies only to those patent claims licensable
|
|
79
|
+
by such Contributor that are necessarily infringed by their
|
|
80
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
81
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
82
|
+
institute patent litigation against any entity (including a
|
|
83
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
84
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
85
|
+
or contributory patent infringement, then any patent licenses
|
|
86
|
+
granted to You under this License for that Work shall terminate
|
|
87
|
+
as of the date such litigation is filed.
|
|
88
|
+
|
|
89
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
90
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
91
|
+
modifications, and in Source or Object form, provided that You
|
|
92
|
+
meet the following conditions:
|
|
93
|
+
|
|
94
|
+
(a) You must give any other recipients of the Work or
|
|
95
|
+
Derivative Works a copy of this License; and
|
|
96
|
+
|
|
97
|
+
(b) You must cause any modified files to carry prominent notices
|
|
98
|
+
stating that You changed the files; and
|
|
99
|
+
|
|
100
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
101
|
+
that You distribute, all copyright, patent, trademark, and
|
|
102
|
+
attribution notices from the Source form of the Work,
|
|
103
|
+
excluding those notices that do not pertain to any part of
|
|
104
|
+
the Derivative Works; and
|
|
105
|
+
|
|
106
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
107
|
+
distribution, then any Derivative Works that You distribute must
|
|
108
|
+
include a readable copy of the attribution notices contained
|
|
109
|
+
within such NOTICE file, excluding those notices that do not
|
|
110
|
+
pertain to any part of the Derivative Works, in at least one
|
|
111
|
+
of the following places: within a NOTICE text file distributed
|
|
112
|
+
as part of the Derivative Works; within the Source form or
|
|
113
|
+
documentation, if provided along with the Derivative Works; or,
|
|
114
|
+
within a display generated by the Derivative Works, if and
|
|
115
|
+
wherever such third-party notices normally appear. The contents
|
|
116
|
+
of the NOTICE file are for informational purposes only and
|
|
117
|
+
do not modify the License. You may add Your own attribution
|
|
118
|
+
notices within Derivative Works that You distribute, alongside
|
|
119
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
120
|
+
that such additional attribution notices cannot be construed
|
|
121
|
+
as modifying the License.
|
|
122
|
+
|
|
123
|
+
You may add Your own copyright statement to Your modifications and
|
|
124
|
+
may provide additional or different license terms and conditions
|
|
125
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
126
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
127
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
128
|
+
the conditions stated in this License.
|
|
129
|
+
|
|
130
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
131
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
132
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
133
|
+
this License, without any additional terms or conditions.
|
|
134
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
135
|
+
the terms of any separate license agreement you may have executed
|
|
136
|
+
with Licensor regarding such Contributions.
|
|
137
|
+
|
|
138
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
139
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
140
|
+
except as required for reasonable and customary use in describing the
|
|
141
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
142
|
+
|
|
143
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
144
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
145
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
146
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
147
|
+
implied, including, without limitation, any warranties or conditions
|
|
148
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
149
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
150
|
+
appropriateness of using or redistributing the Work and assume any
|
|
151
|
+
risks associated with Your exercise of permissions under this License.
|
|
152
|
+
|
|
153
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
154
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
155
|
+
unless required by applicable law (such as deliberate and grossly
|
|
156
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
157
|
+
liable to You for damages, including any direct, indirect, special,
|
|
158
|
+
incidental, or consequential damages of any character arising as a
|
|
159
|
+
result of this License or out of the use or inability to use the
|
|
160
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
161
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
162
|
+
other commercial damages or losses), even if such Contributor
|
|
163
|
+
has been advised of the possibility of such damages.
|
|
164
|
+
|
|
165
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
166
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
167
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
168
|
+
or other liability obligations and/or rights consistent with this
|
|
169
|
+
License. However, in accepting such obligations, You may act only
|
|
170
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
171
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
172
|
+
defend, and hold each Contributor harmless for any liability
|
|
173
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
174
|
+
of your accepting any such warranty or additional liability.
|
|
175
|
+
|
|
176
|
+
END OF TERMS AND CONDITIONS
|
|
177
|
+
|
|
178
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
179
|
+
|
|
180
|
+
To apply the Apache License to your work, attach the following
|
|
181
|
+
boilerplate notice, with the fields enclosed by brackets "{}"
|
|
182
|
+
replaced with your own identifying information. (Don't include
|
|
183
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
184
|
+
comment syntax for the file format. We also recommend that a
|
|
185
|
+
file or class name and description of purpose be included on the
|
|
186
|
+
same "printed page" as the copyright notice for easier
|
|
187
|
+
identification within third-party archives.
|
|
188
|
+
|
|
189
|
+
Copyright 2017 Uken Studios, Inc.
|
|
190
|
+
|
|
191
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
192
|
+
you may not use this file except in compliance with the License.
|
|
193
|
+
You may obtain a copy of the License at
|
|
194
|
+
|
|
195
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
196
|
+
|
|
197
|
+
Unless required by applicable law or agreed to in writing, software
|
|
198
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
199
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
200
|
+
See the License for the specific language governing permissions and
|
|
201
|
+
limitations under the License.
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
DESCRIPTION HERE
|
|
2
|
+
|
|
3
|
+
(check all that apply)
|
|
4
|
+
- [ ] tests added
|
|
5
|
+
- [ ] tests passing
|
|
6
|
+
- [ ] README updated (if needed)
|
|
7
|
+
- [ ] README Table of Contents updated (if needed)
|
|
8
|
+
- [ ] History.md and `version` in gemspec are untouched
|
|
9
|
+
- [ ] backward compatible
|
|
10
|
+
- [ ] feature works in `elasticsearch_dynamic` (not required but recommended)
|
data/README.md
ADDED
|
@@ -0,0 +1,1558 @@
|
|
|
1
|
+
# Fluent::Plugin::Elasticsearch, a plugin for [Fluentd](http://fluentd.org)
|
|
2
|
+
|
|
3
|
+
[](http://badge.fury.io/rb/fluent-plugin-elasticsearch)
|
|
4
|
+
[](https://travis-ci.org/uken/fluent-plugin-elasticsearch)
|
|
5
|
+
[](https://coveralls.io/r/uken/fluent-plugin-elasticsearch)
|
|
6
|
+
[](https://codeclimate.com/github/uken/fluent-plugin-elasticsearch)
|
|
7
|
+
|
|
8
|
+
Send your logs to Elasticsearch (and search them with Kibana maybe?)
|
|
9
|
+
|
|
10
|
+
Note: For Amazon Elasticsearch Service please consider using [fluent-plugin-aws-elasticsearch-service](https://github.com/atomita/fluent-plugin-aws-elasticsearch-service)
|
|
11
|
+
|
|
12
|
+
Current maintainers: @cosmo0920
|
|
13
|
+
|
|
14
|
+
* [Installation](#installation)
|
|
15
|
+
* [Usage](#usage)
|
|
16
|
+
+ [Index templates](#index-templates)
|
|
17
|
+
* [Configuration](#configuration)
|
|
18
|
+
+ [host](#host)
|
|
19
|
+
+ [port](#port)
|
|
20
|
+
+ [emit_error_for_missing_id](#emit_error_for_missing_id)
|
|
21
|
+
+ [hosts](#hosts)
|
|
22
|
+
+ [user, password, path, scheme, ssl_verify](#user-password-path-scheme-ssl_verify)
|
|
23
|
+
+ [logstash_format](#logstash_format)
|
|
24
|
+
+ [logstash_prefix](#logstash_prefix)
|
|
25
|
+
+ [logstash_prefix_separator](#logstash_prefix_separator)
|
|
26
|
+
+ [logstash_dateformat](#logstash_dateformat)
|
|
27
|
+
+ [pipeline](#pipeline)
|
|
28
|
+
+ [time_key_format](#time_key_format)
|
|
29
|
+
+ [time_precision](#time_precision)
|
|
30
|
+
+ [time_key](#time_key)
|
|
31
|
+
+ [time_key_exclude_timestamp](#time_key_exclude_timestamp)
|
|
32
|
+
+ [include_timestamp](#include_timestamp)
|
|
33
|
+
+ [utc_index](#utc_index)
|
|
34
|
+
+ [target_index_key](#target_index_key)
|
|
35
|
+
+ [target_type_key](#target_type_key)
|
|
36
|
+
+ [template_name](#template_name)
|
|
37
|
+
+ [template_file](#template_file)
|
|
38
|
+
+ [template_overwrite](#template_overwrite)
|
|
39
|
+
+ [customize_template](#customize_template)
|
|
40
|
+
+ [rollover_index](#rollover_index)
|
|
41
|
+
+ [index_date_pattern](#index_date_pattern)
|
|
42
|
+
+ [deflector_alias](#deflector_alias)
|
|
43
|
+
+ [application_name](#application_name)
|
|
44
|
+
+ [index_prefix](#index_prefix)
|
|
45
|
+
+ [templates](#templates)
|
|
46
|
+
+ [max_retry_putting_template](#max_retry_putting_template)
|
|
47
|
+
+ [fail_on_putting_template_retry_exceed](#fail_on_putting_template_retry_exceed)
|
|
48
|
+
+ [max_retry_get_es_version](#max_retry_get_es_version)
|
|
49
|
+
+ [request_timeout](#request_timeout)
|
|
50
|
+
+ [reload_connections](#reload_connections)
|
|
51
|
+
+ [reload_on_failure](#reload_on_failure)
|
|
52
|
+
+ [resurrect_after](#resurrect_after)
|
|
53
|
+
+ [include_tag_key, tag_key](#include_tag_key-tag_key)
|
|
54
|
+
+ [id_key](#id_key)
|
|
55
|
+
+ [parent_key](#parent_key)
|
|
56
|
+
+ [routing_key](#routing_key)
|
|
57
|
+
+ [remove_keys](#remove_keys)
|
|
58
|
+
+ [remove_keys_on_update](#remove_keys_on_update)
|
|
59
|
+
+ [remove_keys_on_update_key](#remove_keys_on_update_key)
|
|
60
|
+
+ [retry_tag](#retry_tag)
|
|
61
|
+
+ [write_operation](#write_operation)
|
|
62
|
+
+ [time_parse_error_tag](#time_parse_error_tag)
|
|
63
|
+
+ [reconnect_on_error](#reconnect_on_error)
|
|
64
|
+
+ [with_transporter_log](#with_transporter_log)
|
|
65
|
+
+ [content_type](#content_type)
|
|
66
|
+
+ [include_index_in_url](#include_index_in_url)
|
|
67
|
+
+ [http_backend](#http_backend)
|
|
68
|
+
+ [prefer_oj_serializer](#prefer_oj_serializer)
|
|
69
|
+
+ [Client/host certificate options](#clienthost-certificate-options)
|
|
70
|
+
+ [Proxy Support](#proxy-support)
|
|
71
|
+
+ [Buffer options](#buffer-options)
|
|
72
|
+
+ [Hash flattening](#hash-flattening)
|
|
73
|
+
+ [Generate Hash ID](#generate-hash-id)
|
|
74
|
+
+ [sniffer_class_name](#sniffer-class-name)
|
|
75
|
+
+ [reload_after](#reload-after)
|
|
76
|
+
+ [validate_client_version](#validate-client-version)
|
|
77
|
+
+ [unrecoverable_error_types](#unrecoverable-error-types)
|
|
78
|
+
+ [verify_es version at startup](#verify_es_version_at_startup)
|
|
79
|
+
+ [default_elasticsearch_version](#default_elasticsearch_version)
|
|
80
|
+
+ [custom_headers](#custom_headers)
|
|
81
|
+
+ [Not seeing a config you need?](#not-seeing-a-config-you-need)
|
|
82
|
+
+ [Dynamic configuration](#dynamic-configuration)
|
|
83
|
+
+ [Placeholders](#placeholders)
|
|
84
|
+
+ [Multi workers](#multi-workers)
|
|
85
|
+
+ [log_es_400_reason](#log_es_400_reason)
|
|
86
|
+
+ [suppress_doc_wrap](#suppress_doc_wrap)
|
|
87
|
+
+ [ignore_exceptions](#ignore_exceptions)
|
|
88
|
+
+ [exception_backup](#exception_backup)
|
|
89
|
+
+ [bulk_message_request_threshold](#bulk_message_request_threshold)
|
|
90
|
+
* [Troubleshooting](#troubleshooting)
|
|
91
|
+
+ [Cannot send events to elasticsearch](#cannot-send-events-to-elasticsearch)
|
|
92
|
+
+ [Cannot see detailed failure log](#cannot-see-detailed-failure-log)
|
|
93
|
+
+ [Cannot connect TLS enabled reverse Proxy](#cannot-connect-tls-enabled-reverse-proxy)
|
|
94
|
+
+ [Declined logs are resubmitted forever, why?](#declined-logs-are-resubmitted-forever-why)
|
|
95
|
+
+ [Suggested to increase flush_thread_count, why?](#suggested-to-increase-flush_thread_count-why)
|
|
96
|
+
+ [Suggested to install typhoeus gem, why?](#suggested-to-install-typhoeus-gem-why)
|
|
97
|
+
+ [Stopped to send events on k8s, why?](#stopped-to-send-events-on-k8s-why)
|
|
98
|
+
+ [Random 400 - Rejected by Elasticsearch is occured, why?](#random-400---rejected-by-elasticsearch-is-occured-why)
|
|
99
|
+
+ [Fluentd seems to hang if it unable to connect Elasticsearch, why?](#fluentd-seems-to-hang-if-it-unable-to-connect-elasticsearch-why)
|
|
100
|
+
* [Contact](#contact)
|
|
101
|
+
* [Contributing](#contributing)
|
|
102
|
+
* [Running tests](#running-tests)
|
|
103
|
+
|
|
104
|
+
## Requirements
|
|
105
|
+
|
|
106
|
+
| fluent-plugin-elasticsearch | fluentd | ruby |
|
|
107
|
+
|-------------------|---------|------|
|
|
108
|
+
| >= 2.0.0 | >= v0.14.20 | >= 2.1 |
|
|
109
|
+
| < 2.0.0 | >= v0.12.0 | >= 1.9 |
|
|
110
|
+
|
|
111
|
+
NOTE: For v0.12 version, you should use 1.x.y version. Please send patch into v0.12 branch if you encountered 1.x version's bug.
|
|
112
|
+
|
|
113
|
+
NOTE: This documentation is for fluent-plugin-elasticsearch 2.x or later. For 1.x documentation, please see [v0.12 branch](https://github.com/uken/fluent-plugin-elasticsearch/tree/v0.12).
|
|
114
|
+
|
|
115
|
+
## Installation
|
|
116
|
+
|
|
117
|
+
```sh
|
|
118
|
+
$ gem install fluent-plugin-elasticsearch
|
|
119
|
+
```
|
|
120
|
+
|
|
121
|
+
## Usage
|
|
122
|
+
|
|
123
|
+
In your Fluentd configuration, use `@type elasticsearch`. Additional configuration is optional, default values would look like this:
|
|
124
|
+
|
|
125
|
+
```
|
|
126
|
+
<match my.logs>
|
|
127
|
+
@type elasticsearch
|
|
128
|
+
host localhost
|
|
129
|
+
port 9200
|
|
130
|
+
index_name fluentd
|
|
131
|
+
type_name fluentd
|
|
132
|
+
</match>
|
|
133
|
+
```
|
|
134
|
+
|
|
135
|
+
### Index templates
|
|
136
|
+
|
|
137
|
+
This plugin creates Elasticsearch indices by merely writing to them. Consider using [Index Templates](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) to gain control of what get indexed and how. See [this example](https://github.com/uken/fluent-plugin-elasticsearch/issues/33#issuecomment-38693282) for a good starting point.
|
|
138
|
+
|
|
139
|
+
## Configuration
|
|
140
|
+
|
|
141
|
+
### host
|
|
142
|
+
|
|
143
|
+
```
|
|
144
|
+
host user-custom-host.domain # default localhost
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
You can specify Elasticsearch host by this parameter.
|
|
148
|
+
|
|
149
|
+
**Note:** Since v3.3.2, `host` parameter supports builtin placeholders. If you want to send events dynamically into different hosts at runtime with `elasticsearch_dynamic` output plugin, please consider to switch to use plain `elasticsearch` output plugin. In more detail for builtin placeholders, please refer to [Placeholders](#placeholders) section.
|
|
150
|
+
|
|
151
|
+
### port
|
|
152
|
+
|
|
153
|
+
```
|
|
154
|
+
port 9201 # defaults to 9200
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
You can specify Elasticsearch port by this parameter.
|
|
158
|
+
|
|
159
|
+
### emit_error_for_missing_id
|
|
160
|
+
|
|
161
|
+
```
|
|
162
|
+
emit_error_for_missing_id true
|
|
163
|
+
```
|
|
164
|
+
When `write_operation` is configured to anything other then `index`, setting this value to `true` will
|
|
165
|
+
cause the plugin to `emit_error_event` of any records which do not include an `_id` field. The default (`false`)
|
|
166
|
+
behavior is to silently drop the records.
|
|
167
|
+
|
|
168
|
+
### hosts
|
|
169
|
+
|
|
170
|
+
```
|
|
171
|
+
hosts host1:port1,host2:port2,host3:port3
|
|
172
|
+
```
|
|
173
|
+
|
|
174
|
+
You can specify multiple Elasticsearch hosts with separator ",".
|
|
175
|
+
|
|
176
|
+
If you specify multiple hosts, this plugin will load balance updates to Elasticsearch. This is an [elasticsearch-ruby](https://github.com/elasticsearch/elasticsearch-ruby) feature, the default strategy is round-robin.
|
|
177
|
+
|
|
178
|
+
If you specify `hosts` option, `host` and `port` options are ignored.
|
|
179
|
+
|
|
180
|
+
```
|
|
181
|
+
host user-custom-host.domain # ignored
|
|
182
|
+
port 9200 # ignored
|
|
183
|
+
hosts host1:port1,host2:port2,host3:port3
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
If you specify `hosts` option without port, `port` option is used.
|
|
187
|
+
|
|
188
|
+
```
|
|
189
|
+
port 9200
|
|
190
|
+
hosts host1:port1,host2:port2,host3 # port3 is 9200
|
|
191
|
+
```
|
|
192
|
+
|
|
193
|
+
**Note:** If you will use scheme https, do not include "https://" in your hosts ie. host "https://domain", this will cause ES cluster to be unreachable and you will receive an error "Can not reach Elasticsearch cluster"
|
|
194
|
+
|
|
195
|
+
**Note:** Up until v2.8.5, it was allowed to embed the username/password in the URL. However, this syntax is deprecated as of v2.8.6 because it was found to cause serious connection problems (See #394). Please migrate your settings to use the `user` and `password` field (described below) instead.
|
|
196
|
+
|
|
197
|
+
### user, password, path, scheme, ssl_verify
|
|
198
|
+
|
|
199
|
+
```
|
|
200
|
+
user demo
|
|
201
|
+
password secret
|
|
202
|
+
path /elastic_search/
|
|
203
|
+
scheme https
|
|
204
|
+
```
|
|
205
|
+
|
|
206
|
+
You can specify user and password for HTTP Basic authentication.
|
|
207
|
+
|
|
208
|
+
And this plugin will escape required URL encoded characters within `%{}` placeholders.
|
|
209
|
+
|
|
210
|
+
```
|
|
211
|
+
user %{demo+}
|
|
212
|
+
password %{@secret}
|
|
213
|
+
```
|
|
214
|
+
|
|
215
|
+
Specify `ssl_verify false` to skip ssl verification (defaults to true)
|
|
216
|
+
|
|
217
|
+
### logstash_format
|
|
218
|
+
|
|
219
|
+
```
|
|
220
|
+
logstash_format true # defaults to false
|
|
221
|
+
```
|
|
222
|
+
|
|
223
|
+
This is meant to make writing data into Elasticsearch indices compatible to what [Logstash](https://www.elastic.co/products/logstash) calls them. By doing this, one could take advantage of [Kibana](https://www.elastic.co/products/kibana). See logstash_prefix and logstash_dateformat to customize this index name pattern. The index name will be `#{logstash_prefix}-#{formatted_date}`
|
|
224
|
+
|
|
225
|
+
:warning: Setting this option to `true` will ignore the `index_name` setting. The default index name prefix is `logstash-`.
|
|
226
|
+
|
|
227
|
+
### include_timestamp
|
|
228
|
+
|
|
229
|
+
```
|
|
230
|
+
include_timestamp true # defaults to false
|
|
231
|
+
```
|
|
232
|
+
|
|
233
|
+
Adds a `@timestamp` field to the log, following all settings `logstash_format` does, except without the restrictions on `index_name`. This allows one to log to an alias in Elasticsearch and utilize the rollover API.
|
|
234
|
+
|
|
235
|
+
### logstash_prefix
|
|
236
|
+
|
|
237
|
+
```
|
|
238
|
+
logstash_prefix mylogs # defaults to "logstash"
|
|
239
|
+
```
|
|
240
|
+
|
|
241
|
+
### logstash_prefix_separator
|
|
242
|
+
|
|
243
|
+
```
|
|
244
|
+
logstash_prefix_separator _ # defaults to "-"
|
|
245
|
+
```
|
|
246
|
+
|
|
247
|
+
### logstash_dateformat
|
|
248
|
+
|
|
249
|
+
The strftime format to generate index target index name when `logstash_format` is set to true. By default, the records are inserted into index `logstash-YYYY.MM.DD`. This option, alongwith `logstash_prefix` lets us insert into specified index like `mylogs-YYYYMM` for a monthly index.
|
|
250
|
+
|
|
251
|
+
```
|
|
252
|
+
logstash_dateformat %Y.%m. # defaults to "%Y.%m.%d"
|
|
253
|
+
```
|
|
254
|
+
|
|
255
|
+
### pipeline
|
|
256
|
+
|
|
257
|
+
Only in ES >= 5.x is available to use this parameter.
|
|
258
|
+
This param is to set a pipeline id of your elasticsearch to be added into the request, you can configure ingest node.
|
|
259
|
+
For more information: []
|
|
260
|
+
|
|
261
|
+
```
|
|
262
|
+
pipeline pipeline_id
|
|
263
|
+
```
|
|
264
|
+
|
|
265
|
+
### time_key_format
|
|
266
|
+
|
|
267
|
+
The format of the time stamp field (`@timestamp` or what you specify with [time_key](#time_key)). This parameter only has an effect when [logstash_format](#logstash_format) is true as it only affects the name of the index we write to. Please see [Time#strftime](http://ruby-doc.org/core-1.9.3/Time.html#method-i-strftime) for information about the value of this format.
|
|
268
|
+
|
|
269
|
+
Setting this to a known format can vastly improve your log ingestion speed if all most of your logs are in the same format. If there is an error parsing this format the timestamp will default to the ingestion time. If you are on Ruby 2.0 or later you can get a further performance improvement by installing the "strptime" gem: `fluent-gem install strptime`.
|
|
270
|
+
|
|
271
|
+
For example to parse ISO8601 times with sub-second precision:
|
|
272
|
+
|
|
273
|
+
```
|
|
274
|
+
time_key_format %Y-%m-%dT%H:%M:%S.%N%z
|
|
275
|
+
```
|
|
276
|
+
|
|
277
|
+
### time_precision
|
|
278
|
+
|
|
279
|
+
Should the record not include a `time_key`, define the degree of sub-second time precision to preserve from the `time` portion of the routed event.
|
|
280
|
+
|
|
281
|
+
For example, should your input plugin not include a `time_key` in the record but it able to pass a `time` to the router when emitting the event (AWS CloudWatch events are an example of this), then this setting will allow you to preserve the sub-second time resolution of those events. This is the case for: [fluent-plugin-cloudwatch-ingest](https://github.com/sampointer/fluent-plugin-cloudwatch-ingest).
|
|
282
|
+
|
|
283
|
+
### time_key
|
|
284
|
+
|
|
285
|
+
By default, when inserting records in [Logstash](https://www.elastic.co/products/logstash) format, `@timestamp` is dynamically created with the time at log ingestion. If you'd like to use a custom time, include an `@timestamp` with your record.
|
|
286
|
+
|
|
287
|
+
```
|
|
288
|
+
{"@timestamp": "2014-04-07T000:00:00-00:00"}
|
|
289
|
+
```
|
|
290
|
+
|
|
291
|
+
You can specify an option `time_key` (like the option described in [tail Input Plugin](http://docs.fluentd.org/articles/in_tail)) to replace `@timestamp` key.
|
|
292
|
+
|
|
293
|
+
Suppose you have settings
|
|
294
|
+
|
|
295
|
+
```
|
|
296
|
+
logstash_format true
|
|
297
|
+
time_key vtm
|
|
298
|
+
```
|
|
299
|
+
|
|
300
|
+
Your input is:
|
|
301
|
+
```
|
|
302
|
+
{
|
|
303
|
+
"title": "developer",
|
|
304
|
+
"vtm": "2014-12-19T08:01:03Z"
|
|
305
|
+
}
|
|
306
|
+
```
|
|
307
|
+
|
|
308
|
+
The output will be
|
|
309
|
+
```
|
|
310
|
+
{
|
|
311
|
+
"title": "developer",
|
|
312
|
+
"@timestamp": "2014-12-19T08:01:03Z",
|
|
313
|
+
"vtm": "2014-12-19T08:01:03Z"
|
|
314
|
+
}
|
|
315
|
+
```
|
|
316
|
+
|
|
317
|
+
See `time_key_exclude_timestamp` to avoid adding `@timestamp`.
|
|
318
|
+
|
|
319
|
+
### time_key_exclude_timestamp
|
|
320
|
+
|
|
321
|
+
```
|
|
322
|
+
time_key_exclude_timestamp false
|
|
323
|
+
```
|
|
324
|
+
|
|
325
|
+
By default, setting `time_key` will copy the value to an additional field `@timestamp`. When setting `time_key_exclude_timestamp true`, no additional field will be added.
|
|
326
|
+
|
|
327
|
+
### utc_index
|
|
328
|
+
|
|
329
|
+
```
|
|
330
|
+
utc_index true
|
|
331
|
+
```
|
|
332
|
+
|
|
333
|
+
By default, the records inserted into index `logstash-YYMMDD` with UTC (Coordinated Universal Time). This option allows to use local time if you describe utc_index to false.
|
|
334
|
+
|
|
335
|
+
### target_index_key
|
|
336
|
+
|
|
337
|
+
Tell this plugin to find the index name to write to in the record under this key in preference to other mechanisms. Key can be specified as path to nested record using dot ('.') as a separator.
|
|
338
|
+
|
|
339
|
+
If it is present in the record (and the value is non falsy) the value will be used as the index name to write to and then removed from the record before output; if it is not found then it will use logstash_format or index_name settings as configured.
|
|
340
|
+
|
|
341
|
+
Suppose you have the following settings
|
|
342
|
+
|
|
343
|
+
```
|
|
344
|
+
target_index_key @target_index
|
|
345
|
+
index_name fallback
|
|
346
|
+
```
|
|
347
|
+
|
|
348
|
+
If your input is:
|
|
349
|
+
```
|
|
350
|
+
{
|
|
351
|
+
"title": "developer",
|
|
352
|
+
"@timestamp": "2014-12-19T08:01:03Z",
|
|
353
|
+
"@target_index": "logstash-2014.12.19"
|
|
354
|
+
}
|
|
355
|
+
```
|
|
356
|
+
|
|
357
|
+
The output would be
|
|
358
|
+
|
|
359
|
+
```
|
|
360
|
+
{
|
|
361
|
+
"title": "developer",
|
|
362
|
+
"@timestamp": "2014-12-19T08:01:03Z",
|
|
363
|
+
}
|
|
364
|
+
```
|
|
365
|
+
|
|
366
|
+
and this record will be written to the specified index (`logstash-2014.12.19`) rather than `fallback`.
|
|
367
|
+
|
|
368
|
+
### target_type_key
|
|
369
|
+
|
|
370
|
+
Similar to `target_index_key` config, find the type name to write to in the record under this key (or nested record). If key not found in record - fallback to `type_name` (default "fluentd").
|
|
371
|
+
|
|
372
|
+
### template_name
|
|
373
|
+
|
|
374
|
+
The name of the template to define. If a template by the name given is already present, it will be left unchanged, unless [template_overwrite](#template_overwrite) is set, in which case the template will be updated.
|
|
375
|
+
|
|
376
|
+
This parameter along with template_file allow the plugin to behave similarly to Logstash (it installs a template at creation time) so that raw records are available. See [https://github.com/uken/fluent-plugin-elasticsearch/issues/33](https://github.com/uken/fluent-plugin-elasticsearch/issues/33).
|
|
377
|
+
|
|
378
|
+
[template_file](#template_file) must also be specified.
|
|
379
|
+
|
|
380
|
+
### template_file
|
|
381
|
+
|
|
382
|
+
The path to the file containing the template to install.
|
|
383
|
+
|
|
384
|
+
[template_name](#template_name) must also be specified.
|
|
385
|
+
|
|
386
|
+
### templates
|
|
387
|
+
|
|
388
|
+
Specify index templates in form of hash. Can contain multiple templates.
|
|
389
|
+
|
|
390
|
+
```
|
|
391
|
+
templates { "template_name_1": "path_to_template_1_file", "template_name_2": "path_to_template_2_file"}
|
|
392
|
+
```
|
|
393
|
+
|
|
394
|
+
If `template_file` and `template_name` are set, then this parameter will be ignored.
|
|
395
|
+
|
|
396
|
+
### customize_template
|
|
397
|
+
|
|
398
|
+
Specify the string and its value to be replaced in form of hash. Can contain multiple key value pair that would be replaced in the specified template_file.
|
|
399
|
+
This setting only creates template and to add rollover index please check the [rollover_index](#rollover_index) configuration.
|
|
400
|
+
|
|
401
|
+
```
|
|
402
|
+
customize_template {"string_1": "subs_value_1", "string_2": "subs_value_2"}
|
|
403
|
+
```
|
|
404
|
+
|
|
405
|
+
If [template_file](#template_file) and [template_name](#template_name) are set, then this parameter will be in effect otherwise ignored.
|
|
406
|
+
|
|
407
|
+
### rollover_index
|
|
408
|
+
|
|
409
|
+
Specify this as true when an index with rollover capability needs to be created. It creates an index with the format <logstash-default-{now/d}-000001> where logstash denotes the index_prefix and default denotes the application_name which can be set.
|
|
410
|
+
'deflector_alias' is a required field for rollover_index set to true.
|
|
411
|
+
'index_prefix' and 'application_name' are optional and defaults to logstash and default respectively.
|
|
412
|
+
```
|
|
413
|
+
rollover_index true # defaults to false
|
|
414
|
+
```
|
|
415
|
+
|
|
416
|
+
If [customize_template](#customize_template) is set, then this parameter will be in effect otherwise ignored.
|
|
417
|
+
|
|
418
|
+
### index_date_pattern
|
|
419
|
+
|
|
420
|
+
Specify this to override the index date pattern for creating a rollover index. The default is to use "now/d",
|
|
421
|
+
for example: <logstash-default-{now/d}-000001>. Overriding this changes the rollover time period. Setting
|
|
422
|
+
"now/w{xxxx.ww}" would create weekly rollover indexes instead of daily.
|
|
423
|
+
|
|
424
|
+
This setting only takes effect when combined with the [rollover_index](#rollover_index) setting.
|
|
425
|
+
```
|
|
426
|
+
index_date_pattern "now/w{xxxx.ww}" # defaults to "now/d"
|
|
427
|
+
```
|
|
428
|
+
|
|
429
|
+
If [customize_template](#customize_template) is set, then this parameter will be in effect otherwise ignored.
|
|
430
|
+
|
|
431
|
+
### deflector_alias
|
|
432
|
+
|
|
433
|
+
Specify the deflector alias which would be assigned to the rollover index created. This is useful in case of using the Elasticsearch rollover API
|
|
434
|
+
```
|
|
435
|
+
deflector_alias test-current
|
|
436
|
+
```
|
|
437
|
+
|
|
438
|
+
If [rollover_index](#rollover_index) is set, then this parameter will be in effect otherwise ignored.
|
|
439
|
+
|
|
440
|
+
### index_prefix
|
|
441
|
+
|
|
442
|
+
Specify the index prefix for the rollover index to be created.
|
|
443
|
+
```
|
|
444
|
+
index_prefix mylogs # defaults to "logstash"
|
|
445
|
+
```
|
|
446
|
+
|
|
447
|
+
If [rollover_index](#rollover_index) is set, then this parameter will be in effect otherwise ignored.
|
|
448
|
+
|
|
449
|
+
### application_name
|
|
450
|
+
|
|
451
|
+
Specify the application name for the rollover index to be created.
|
|
452
|
+
```
|
|
453
|
+
application_name default # defaults to "default"
|
|
454
|
+
```
|
|
455
|
+
|
|
456
|
+
If [rollover_index](#rollover_index) is set, then this parameter will be in effect otherwise ignored.
|
|
457
|
+
|
|
458
|
+
### template_overwrite
|
|
459
|
+
|
|
460
|
+
Always update the template, even if it already exists.
|
|
461
|
+
|
|
462
|
+
```
|
|
463
|
+
template_overwrite true # defaults to false
|
|
464
|
+
```
|
|
465
|
+
|
|
466
|
+
One of [template_file](#template_file) or [templates](#templates) must also be specified if this is set.
|
|
467
|
+
|
|
468
|
+
### max_retry_putting_template
|
|
469
|
+
|
|
470
|
+
You can specify times of retry putting template.
|
|
471
|
+
|
|
472
|
+
This is useful when Elasticsearch plugin cannot connect Elasticsearch to put template.
|
|
473
|
+
Usually, booting up clustered Elasticsearch containers are much slower than launching Fluentd container.
|
|
474
|
+
|
|
475
|
+
```
|
|
476
|
+
max_retry_putting_template 15 # defaults to 10
|
|
477
|
+
```
|
|
478
|
+
|
|
479
|
+
### fail_on_putting_template_retry_exceed
|
|
480
|
+
|
|
481
|
+
Indicates whether to fail when `max_retry_putting_template` is exceeded.
|
|
482
|
+
If you have multiple output plugin, you could use this property to do not fail on fluentd statup.
|
|
483
|
+
|
|
484
|
+
```
|
|
485
|
+
fail_on_putting_template_retry_exceed false # defaults to true
|
|
486
|
+
```
|
|
487
|
+
|
|
488
|
+
### max_retry_get_es_version
|
|
489
|
+
|
|
490
|
+
You can specify times of retry obtaining Elasticsearch version.
|
|
491
|
+
|
|
492
|
+
This is useful when Elasticsearch plugin cannot connect Elasticsearch to obtain Elasticsearch version.
|
|
493
|
+
Usually, booting up clustered Elasticsearch containers are much slower than launching Fluentd container.
|
|
494
|
+
|
|
495
|
+
```
|
|
496
|
+
max_retry_get_es_version 17 # defaults to 15
|
|
497
|
+
```
|
|
498
|
+
|
|
499
|
+
### request_timeout
|
|
500
|
+
|
|
501
|
+
You can specify HTTP request timeout.
|
|
502
|
+
|
|
503
|
+
This is useful when Elasticsearch cannot return response for bulk request within the default of 5 seconds.
|
|
504
|
+
|
|
505
|
+
```
|
|
506
|
+
request_timeout 15s # defaults to 5s
|
|
507
|
+
```
|
|
508
|
+
|
|
509
|
+
### reload_connections
|
|
510
|
+
|
|
511
|
+
You can tune how the elasticsearch-transport host reloading feature works. By default it will reload the host list from the server every 10,000th request to spread the load. This can be an issue if your Elasticsearch cluster is behind a Reverse Proxy, as Fluentd process may not have direct network access to the Elasticsearch nodes.
|
|
512
|
+
|
|
513
|
+
```
|
|
514
|
+
reload_connections false # defaults to true
|
|
515
|
+
```
|
|
516
|
+
|
|
517
|
+
### reload_on_failure
|
|
518
|
+
|
|
519
|
+
Indicates that the elasticsearch-transport will try to reload the nodes addresses if there is a failure while making the
|
|
520
|
+
request, this can be useful to quickly remove a dead node from the list of addresses.
|
|
521
|
+
|
|
522
|
+
```
|
|
523
|
+
reload_on_failure true # defaults to false
|
|
524
|
+
```
|
|
525
|
+
|
|
526
|
+
### resurrect_after
|
|
527
|
+
|
|
528
|
+
You can set in the elasticsearch-transport how often dead connections from the elasticsearch-transport's pool will be resurrected.
|
|
529
|
+
|
|
530
|
+
```
|
|
531
|
+
resurrect_after 5s # defaults to 60s
|
|
532
|
+
```
|
|
533
|
+
|
|
534
|
+
### include_tag_key, tag_key
|
|
535
|
+
|
|
536
|
+
```
|
|
537
|
+
include_tag_key true # defaults to false
|
|
538
|
+
tag_key tag # defaults to tag
|
|
539
|
+
```
|
|
540
|
+
|
|
541
|
+
This will add the Fluentd tag in the JSON record. For instance, if you have a config like this:
|
|
542
|
+
|
|
543
|
+
```
|
|
544
|
+
<match my.logs>
|
|
545
|
+
@type elasticsearch
|
|
546
|
+
include_tag_key true
|
|
547
|
+
tag_key _key
|
|
548
|
+
</match>
|
|
549
|
+
```
|
|
550
|
+
|
|
551
|
+
The record inserted into Elasticsearch would be
|
|
552
|
+
|
|
553
|
+
```
|
|
554
|
+
{"_key": "my.logs", "name": "Johnny Doeie"}
|
|
555
|
+
```
|
|
556
|
+
|
|
557
|
+
### id_key
|
|
558
|
+
|
|
559
|
+
```
|
|
560
|
+
id_key request_id # use "request_id" field as a record id in ES
|
|
561
|
+
```
|
|
562
|
+
|
|
563
|
+
By default, all records inserted into Elasticsearch get a random _id. This option allows to use a field in the record as an identifier.
|
|
564
|
+
|
|
565
|
+
This following record `{"name": "Johnny", "request_id": "87d89af7daffad6"}` will trigger the following Elasticsearch command
|
|
566
|
+
|
|
567
|
+
```
|
|
568
|
+
{ "index" : { "_index": "logstash-2013.01.01", "_type": "fluentd", "_id": "87d89af7daffad6" } }
|
|
569
|
+
{ "name": "Johnny", "request_id": "87d89af7daffad6" }
|
|
570
|
+
```
|
|
571
|
+
|
|
572
|
+
Fluentd re-emits events that failed to be indexed/ingested in Elasticsearch with a new and unique `_id` value, this means that congested Elasticsearch clusters that reject events (due to command queue overflow, for example) will cause Fluentd to re-emit the event with a new `_id`, however Elasticsearch may actually process both (or more) attempts (with some delay) and create duplicate events in the index (since each have a unique `_id` value), one possible workaround is to use the [fluent-plugin-genhashvalue](https://github.com/mtakemi/fluent-plugin-genhashvalue) plugin to generate a unique `_hash` key in the record of each event, this `_hash` record can be used as the `id_key` to prevent Elasticsearch from creating duplicate events.
|
|
573
|
+
|
|
574
|
+
```
|
|
575
|
+
id_key _hash
|
|
576
|
+
```
|
|
577
|
+
|
|
578
|
+
Example configuration for [fluent-plugin-genhashvalue](https://github.com/mtakemi/fluent-plugin-genhashvalue) (review the documentation of the plugin for more details)
|
|
579
|
+
```
|
|
580
|
+
<filter logs.**>
|
|
581
|
+
@type genhashvalue
|
|
582
|
+
keys session_id,request_id
|
|
583
|
+
hash_type md5 # md5/sha1/sha256/sha512
|
|
584
|
+
base64_enc true
|
|
585
|
+
base91_enc false
|
|
586
|
+
set_key _hash
|
|
587
|
+
separator _
|
|
588
|
+
inc_time_as_key true
|
|
589
|
+
inc_tag_as_key true
|
|
590
|
+
</filter>
|
|
591
|
+
```
|
|
592
|
+
|
|
593
|
+
:warning: In order to avoid hash-collisions and loosing data careful consideration is required when choosing the keys in the event record that should be used to calculate the hash
|
|
594
|
+
|
|
595
|
+
#### Using nested key
|
|
596
|
+
|
|
597
|
+
Nested key specifying syntax is also supported.
|
|
598
|
+
|
|
599
|
+
With the following configuration
|
|
600
|
+
|
|
601
|
+
```aconf
|
|
602
|
+
id_key $.nested.request_id
|
|
603
|
+
```
|
|
604
|
+
|
|
605
|
+
and the following nested record
|
|
606
|
+
|
|
607
|
+
```json
|
|
608
|
+
{"nested":{"name": "Johnny", "request_id": "87d89af7daffad6"}}
|
|
609
|
+
```
|
|
610
|
+
|
|
611
|
+
will trigger the following Elasticsearch command
|
|
612
|
+
|
|
613
|
+
```
|
|
614
|
+
{"index":{"_index":"fluentd","_type":"fluentd","_id":"87d89af7daffad6"}}
|
|
615
|
+
{"nested":{"name":"Johnny","request_id":"87d89af7daffad6"}}
|
|
616
|
+
```
|
|
617
|
+
|
|
618
|
+
:warning: Note that [Hash flattening](#hash-flattening) may be conflict nested record feature.
|
|
619
|
+
|
|
620
|
+
### parent_key
|
|
621
|
+
|
|
622
|
+
```
|
|
623
|
+
parent_key a_parent # use "a_parent" field value to set _parent in elasticsearch command
|
|
624
|
+
```
|
|
625
|
+
|
|
626
|
+
If your input is
|
|
627
|
+
```
|
|
628
|
+
{ "name": "Johnny", "a_parent": "my_parent" }
|
|
629
|
+
```
|
|
630
|
+
|
|
631
|
+
Elasticsearch command would be
|
|
632
|
+
|
|
633
|
+
```
|
|
634
|
+
{ "index" : { "_index": "****", "_type": "****", "_id": "****", "_parent": "my_parent" } }
|
|
635
|
+
{ "name": "Johnny", "a_parent": "my_parent" }
|
|
636
|
+
```
|
|
637
|
+
|
|
638
|
+
if `parent_key` is not configed or the `parent_key` is absent in input record, nothing will happen.
|
|
639
|
+
|
|
640
|
+
#### Using nested key
|
|
641
|
+
|
|
642
|
+
Nested key specifying syntax is also supported.
|
|
643
|
+
|
|
644
|
+
With the following configuration
|
|
645
|
+
|
|
646
|
+
```aconf
|
|
647
|
+
parent_key $.nested.a_parent
|
|
648
|
+
```
|
|
649
|
+
|
|
650
|
+
and the following nested record
|
|
651
|
+
|
|
652
|
+
```json
|
|
653
|
+
{"nested":{ "name": "Johnny", "a_parent": "my_parent" }}
|
|
654
|
+
```
|
|
655
|
+
|
|
656
|
+
will trigger the following Elasticsearch command
|
|
657
|
+
|
|
658
|
+
```
|
|
659
|
+
{"index":{"_index":"fluentd","_type":"fluentd","_parent":"my_parent"}}
|
|
660
|
+
{"nested":{"name":"Johnny","a_parent":"my_parent"}}
|
|
661
|
+
```
|
|
662
|
+
|
|
663
|
+
:warning: Note that [Hash flattening](#hash-flattening) may be conflict nested record feature.
|
|
664
|
+
|
|
665
|
+
### routing_key
|
|
666
|
+
|
|
667
|
+
Similar to `parent_key` config, will add `_routing` into elasticsearch command if `routing_key` is set and the field does exist in input event.
|
|
668
|
+
|
|
669
|
+
### remove_keys
|
|
670
|
+
|
|
671
|
+
```
|
|
672
|
+
parent_key a_parent
|
|
673
|
+
routing_key a_routing
|
|
674
|
+
remove_keys a_parent, a_routing # a_parent and a_routing fields won't be sent to elasticsearch
|
|
675
|
+
```
|
|
676
|
+
|
|
677
|
+
### remove_keys_on_update
|
|
678
|
+
|
|
679
|
+
Remove keys on update will not update the configured keys in elasticsearch when a record is being updated.
|
|
680
|
+
This setting only has any effect if the write operation is update or upsert.
|
|
681
|
+
|
|
682
|
+
If the write setting is upsert then these keys are only removed if the record is being
|
|
683
|
+
updated, if the record does not exist (by id) then all of the keys are indexed.
|
|
684
|
+
|
|
685
|
+
```
|
|
686
|
+
remove_keys_on_update foo,bar
|
|
687
|
+
```
|
|
688
|
+
|
|
689
|
+
### remove_keys_on_update_key
|
|
690
|
+
|
|
691
|
+
This setting allows `remove_keys_on_update` to be configured with a key in each record, in much the same way as `target_index_key` works.
|
|
692
|
+
The configured key is removed before indexing in elasticsearch. If both `remove_keys_on_update` and `remove_keys_on_update_key` is
|
|
693
|
+
present in the record then the keys in record are used, if the `remove_keys_on_update_key` is not present then the value of
|
|
694
|
+
`remove_keys_on_update` is used as a fallback.
|
|
695
|
+
|
|
696
|
+
```
|
|
697
|
+
remove_keys_on_update_key keys_to_skip
|
|
698
|
+
```
|
|
699
|
+
|
|
700
|
+
### retry_tag
|
|
701
|
+
|
|
702
|
+
This setting allows custom routing of messages in response to bulk request failures. The default behavior is to emit
|
|
703
|
+
failed records using the same tag that was provided. When set to a value other then `nil`, failed messages are emitted
|
|
704
|
+
with the specified tag:
|
|
705
|
+
|
|
706
|
+
```
|
|
707
|
+
retry_tag 'retry_es'
|
|
708
|
+
```
|
|
709
|
+
**NOTE:** `retry_tag` is optional. If you would rather use labels to reroute retries, add a label (e.g '@label @SOMELABEL') to your fluent
|
|
710
|
+
elasticsearch plugin configuration. Retry records are, by default, submitted for retry to the ROOT label, which means
|
|
711
|
+
records will flow through your fluentd pipeline from the beginning. This may nor may not be a problem if the pipeline
|
|
712
|
+
is idempotent - that is - you can process a record again with no changes. Use tagging or labeling to ensure your retry
|
|
713
|
+
records are not processed again by your fluentd processing pipeline.
|
|
714
|
+
|
|
715
|
+
### write_operation
|
|
716
|
+
|
|
717
|
+
The write_operation can be any of:
|
|
718
|
+
|
|
719
|
+
| Operation | Description |
|
|
720
|
+
| ------------- | ----------- |
|
|
721
|
+
| index (default) | new data is added while existing data (based on its id) is replaced (reindexed).|
|
|
722
|
+
| create | adds new data - if the data already exists (based on its id), the op is skipped.|
|
|
723
|
+
| update | updates existing data (based on its id). If no data is found, the op is skipped.|
|
|
724
|
+
| upsert | known as merge or insert if the data does not exist, updates if the data exists (based on its id).|
|
|
725
|
+
|
|
726
|
+
**Please note, id is required in create, update, and upsert scenario. Without id, the message will be dropped.**
|
|
727
|
+
|
|
728
|
+
### time_parse_error_tag
|
|
729
|
+
|
|
730
|
+
With `logstash_format true`, elasticsearch plugin parses timestamp field for generating index name. If the record has invalid timestamp value, this plugin emits an error event to `@ERROR` label with `time_parse_error_tag` configured tag.
|
|
731
|
+
|
|
732
|
+
Default value is `Fluent::ElasticsearchOutput::TimeParser.error` for backward compatibility. `::` separated tag is not good for tag routing because some plugins assume tag is separated by `.`. We recommend to set this parameter like `time_parse_error_tag es_plugin.output.time.error`.
|
|
733
|
+
We will change default value to `.` separated tag.
|
|
734
|
+
|
|
735
|
+
### reconnect_on_error
|
|
736
|
+
Indicates that the plugin should reset connection on any error (reconnect on next send).
|
|
737
|
+
By default it will reconnect only on "host unreachable exceptions".
|
|
738
|
+
We recommended to set this true in the presence of elasticsearch shield.
|
|
739
|
+
```
|
|
740
|
+
reconnect_on_error true # defaults to false
|
|
741
|
+
```
|
|
742
|
+
|
|
743
|
+
### with_transporter_log
|
|
744
|
+
|
|
745
|
+
This is debugging purpose option to enable to obtain transporter layer log.
|
|
746
|
+
Default value is `false` for backward compatibility.
|
|
747
|
+
|
|
748
|
+
We recommend to set this true if you start to debug this plugin.
|
|
749
|
+
|
|
750
|
+
```
|
|
751
|
+
with_transporter_log true
|
|
752
|
+
```
|
|
753
|
+
|
|
754
|
+
### content_type
|
|
755
|
+
|
|
756
|
+
With `content_type application/x-ndjson`, elasticsearch plugin adds `application/x-ndjson` as `Content-Type` in payload.
|
|
757
|
+
|
|
758
|
+
Default value is `application/json` which is default Content-Type of Elasticsearch requests.
|
|
759
|
+
If you will not use template, it recommends to set `content_type application/x-ndjson`.
|
|
760
|
+
|
|
761
|
+
```
|
|
762
|
+
content_type application/x-ndjson
|
|
763
|
+
```
|
|
764
|
+
|
|
765
|
+
### include_index_in_url
|
|
766
|
+
|
|
767
|
+
With this option set to true, Fluentd manifests the index name in the request URL (rather than in the request body).
|
|
768
|
+
You can use this option to enforce an URL-based access control.
|
|
769
|
+
|
|
770
|
+
```
|
|
771
|
+
include_index_in_url true
|
|
772
|
+
```
|
|
773
|
+
|
|
774
|
+
### http_backend
|
|
775
|
+
|
|
776
|
+
With `http_backend typhoeus`, elasticsearch plugin uses typhoeus faraday http backend.
|
|
777
|
+
Typhoeus can handle HTTP keepalive.
|
|
778
|
+
|
|
779
|
+
Default value is `excon` which is default http_backend of elasticsearch plugin.
|
|
780
|
+
|
|
781
|
+
```
|
|
782
|
+
http_backend typhoeus
|
|
783
|
+
```
|
|
784
|
+
|
|
785
|
+
### prefer_oj_serializer
|
|
786
|
+
|
|
787
|
+
With default behavior, Elasticsearch client uses `Yajl` as JSON encoder/decoder.
|
|
788
|
+
`Oj` is the alternative high performance JSON encoder/decoder.
|
|
789
|
+
When this parameter sets as `true`, Elasticsearch client uses `Oj` as JSON encoder/decoder.
|
|
790
|
+
|
|
791
|
+
Default value is `false`.
|
|
792
|
+
|
|
793
|
+
```
|
|
794
|
+
prefer_oj_serializer true
|
|
795
|
+
```
|
|
796
|
+
|
|
797
|
+
### Client/host certificate options
|
|
798
|
+
|
|
799
|
+
Need to verify Elasticsearch's certificate? You can use the following parameter to specify a CA instead of using an environment variable.
|
|
800
|
+
```
|
|
801
|
+
ca_file /path/to/your/ca/cert
|
|
802
|
+
```
|
|
803
|
+
|
|
804
|
+
Does your Elasticsearch cluster want to verify client connections? You can specify the following parameters to use your client certificate, key, and key password for your connection.
|
|
805
|
+
```
|
|
806
|
+
client_cert /path/to/your/client/cert
|
|
807
|
+
client_key /path/to/your/private/key
|
|
808
|
+
client_key_pass password
|
|
809
|
+
```
|
|
810
|
+
|
|
811
|
+
If you want to configure SSL/TLS version, you can specify ssl\_version parameter.
|
|
812
|
+
```
|
|
813
|
+
ssl_version TLSv1_2 # or [SSLv23, TLSv1, TLSv1_1]
|
|
814
|
+
```
|
|
815
|
+
|
|
816
|
+
:warning: If SSL/TLS enabled, it might have to be required to set ssl\_version.
|
|
817
|
+
|
|
818
|
+
### Proxy Support
|
|
819
|
+
|
|
820
|
+
Starting with version 0.8.0, this gem uses excon, which supports proxy with environment variables - https://github.com/excon/excon#proxy-support
|
|
821
|
+
|
|
822
|
+
### Buffer options
|
|
823
|
+
|
|
824
|
+
`fluentd-plugin-elasticsearch` extends [Fluentd's builtin Output plugin](https://docs.fluentd.org/v0.14/articles/output-plugin-overview) and use `compat_parameters` plugin helper. It adds the following options:
|
|
825
|
+
|
|
826
|
+
```
|
|
827
|
+
buffer_type memory
|
|
828
|
+
flush_interval 60s
|
|
829
|
+
retry_limit 17
|
|
830
|
+
retry_wait 1.0
|
|
831
|
+
num_threads 1
|
|
832
|
+
```
|
|
833
|
+
|
|
834
|
+
The value for option `buffer_chunk_limit` should not exceed value `http.max_content_length` in your Elasticsearch setup (by default it is 100mb).
|
|
835
|
+
|
|
836
|
+
**Note**: If you use or evaluate Fluentd v0.14, you can use `<buffer>` directive to specify buffer configuration, too. In more detail, please refer to the [buffer configuration options for v0.14](https://docs.fluentd.org/v0.14/articles/buffer-plugin-overview#configuration-parameters)
|
|
837
|
+
|
|
838
|
+
**Note**: If you use `disable_retry_limit` in v0.12 or `retry_forever` in v0.14 or later, please be careful to consume memory inexhaustibly.
|
|
839
|
+
|
|
840
|
+
### Hash flattening
|
|
841
|
+
|
|
842
|
+
Elasticsearch will complain if you send object and concrete values to the same field. For example, you might have logs that look this, from different places:
|
|
843
|
+
|
|
844
|
+
{"people" => 100}
|
|
845
|
+
{"people" => {"some" => "thing"}}
|
|
846
|
+
|
|
847
|
+
The second log line will be rejected by the Elasticsearch parser because objects and concrete values can't live in the same field. To combat this, you can enable hash flattening.
|
|
848
|
+
|
|
849
|
+
```
|
|
850
|
+
flatten_hashes true
|
|
851
|
+
flatten_hashes_separator _
|
|
852
|
+
```
|
|
853
|
+
|
|
854
|
+
This will produce elasticsearch output that looks like this:
|
|
855
|
+
{"people_some" => "thing"}
|
|
856
|
+
|
|
857
|
+
Note that the flattener does not deal with arrays at this time.
|
|
858
|
+
|
|
859
|
+
### Generate Hash ID
|
|
860
|
+
|
|
861
|
+
By default, the fluentd elasticsearch plugin does not emit records with a _id field, leaving it to Elasticsearch to generate a unique _id as the record is indexed. When an Elasticsearch cluster is congested and begins to take longer to respond than the configured request_timeout, the fluentd elasticsearch plugin will re-send the same bulk request. Since Elasticsearch can't tell its actually the same request, all documents in the request are indexed again resulting in duplicate data. In certain scenarios, this can result in essentially and infinite loop generating multiple copies of the same data.
|
|
862
|
+
|
|
863
|
+
The bundled elasticsearch_genid filter can generate a unique _hash key for each record, this key may be passed to the id_key parameter in the elasticsearch plugin to communicate to Elasticsearch the uniqueness of the requests so that duplicates will be rejected or simply replace the existing records.
|
|
864
|
+
Here is a sample config:
|
|
865
|
+
|
|
866
|
+
```
|
|
867
|
+
<filter **>
|
|
868
|
+
@type elasticsearch_genid
|
|
869
|
+
hash_id_key _hash # storing generated hash id key (default is _hash)
|
|
870
|
+
</filter>
|
|
871
|
+
<match **>
|
|
872
|
+
@type elasticsearch
|
|
873
|
+
id_key _hash # specify same key name which is specified in hash_id_key
|
|
874
|
+
remove_keys _hash # Elasticsearch doesn't like keys that start with _
|
|
875
|
+
# other settings are omitted.
|
|
876
|
+
</match>
|
|
877
|
+
```
|
|
878
|
+
|
|
879
|
+
### Sniffer Class Name
|
|
880
|
+
|
|
881
|
+
The default Sniffer used by the `Elasticsearch::Transport` class works well when Fluentd has a direct connection
|
|
882
|
+
to all of the Elasticsearch servers and can make effective use of the `_nodes` API. This doesn't work well
|
|
883
|
+
when Fluentd must connect through a load balancer or proxy. The parameter `sniffer_class_name` gives you the
|
|
884
|
+
ability to provide your own Sniffer class to implement whatever connection reload logic you require. In addition,
|
|
885
|
+
there is a new `Fluent::Plugin::ElasticsearchSimpleSniffer` class which reuses the hosts given in the configuration, which
|
|
886
|
+
is typically the hostname of the load balancer or proxy. For example, a configuration like this would cause
|
|
887
|
+
connections to `logging-es` to reload every 100 operations:
|
|
888
|
+
|
|
889
|
+
```
|
|
890
|
+
host logging-es
|
|
891
|
+
port 9200
|
|
892
|
+
reload_connections true
|
|
893
|
+
sniffer_class_name Fluent::Plugin::ElasticsearchSimpleSniffer
|
|
894
|
+
reload_after 100
|
|
895
|
+
```
|
|
896
|
+
|
|
897
|
+
#### Tips
|
|
898
|
+
|
|
899
|
+
The included sniffer class does not required `out_elasticsearch`.
|
|
900
|
+
You should tell Fluentd where the sniffer class exists.
|
|
901
|
+
|
|
902
|
+
If you use td-agent, you must put the following lines into `TD_AGENT_DEFAULT` file:
|
|
903
|
+
|
|
904
|
+
```
|
|
905
|
+
sniffer=$(td-agent-gem contents fluent-plugin-elasticsearch|grep elasticsearch_simple_sniffer.rb)
|
|
906
|
+
TD_AGENT_OPTIONS="--use-v1-config -r $sniffer"
|
|
907
|
+
```
|
|
908
|
+
|
|
909
|
+
If you use Fluentd directly, you must pass the following lines as Fluentd command line option:
|
|
910
|
+
|
|
911
|
+
```
|
|
912
|
+
sniffer=$(td-agent-gem contents fluent-plugin-elasticsearch|grep elasticsearch_simple_sniffer.rb)
|
|
913
|
+
$ fluentd -r $sniffer" [AND YOUR OTHER OPTIONS]
|
|
914
|
+
```
|
|
915
|
+
|
|
916
|
+
### Reload After
|
|
917
|
+
|
|
918
|
+
When `reload_connections true`, this is the integer number of operations after which the plugin will
|
|
919
|
+
reload the connections. The default value is 10000.
|
|
920
|
+
|
|
921
|
+
### Validate Client Version
|
|
922
|
+
|
|
923
|
+
When you use mismatched Elasticsearch server and client libraries, fluent-plugin-elasticsearch cannot send data into Elasticsearch. The default value is `false`.
|
|
924
|
+
|
|
925
|
+
```
|
|
926
|
+
validate_client_version true
|
|
927
|
+
```
|
|
928
|
+
|
|
929
|
+
### Unrecoverable Error Types
|
|
930
|
+
|
|
931
|
+
Default `unrecoverable_error_types` parameter is set up strictly.
|
|
932
|
+
Because `es_rejected_execution_exception` is caused by exceeding Elasticsearch's thread pool capacity.
|
|
933
|
+
Advanced users can increase its capacity, but normal users should follow default behavior.
|
|
934
|
+
|
|
935
|
+
If you want to increase it and forcibly retrying bulk request, please consider to change `unrecoverable_error_types` parameter from default value.
|
|
936
|
+
|
|
937
|
+
Change default value of `thread_pool.bulk.queue_size` in elasticsearch.yml:
|
|
938
|
+
e.g.)
|
|
939
|
+
|
|
940
|
+
```yaml
|
|
941
|
+
thread_pool.bulk.queue_size: 1000
|
|
942
|
+
```
|
|
943
|
+
|
|
944
|
+
Then, remove `es_rejected_execution_exception` from `unrecoverable_error_types` parameter:
|
|
945
|
+
|
|
946
|
+
```
|
|
947
|
+
unrecoverable_error_types ["out_of_memory_error"]
|
|
948
|
+
```
|
|
949
|
+
|
|
950
|
+
### verify_es_version_at_startup
|
|
951
|
+
|
|
952
|
+
Because Elasticsearch plugin should change behavior each of Elasticsearch major versions.
|
|
953
|
+
|
|
954
|
+
For example, Elasticsearch 6 starts to prohibit multiple type_names in one index, and Elasticsearch 7 will handle only `_doc` type_name in index.
|
|
955
|
+
|
|
956
|
+
If you want to disable to verify Elasticsearch version at start up, set it as `false`.
|
|
957
|
+
|
|
958
|
+
When using the following configuration, ES plugin intends to communicate into Elasticsearch 6.
|
|
959
|
+
|
|
960
|
+
```
|
|
961
|
+
verify_es_version_at_startup false
|
|
962
|
+
default_elasticsearch_version 6
|
|
963
|
+
```
|
|
964
|
+
|
|
965
|
+
The default value is `true`.
|
|
966
|
+
|
|
967
|
+
### default_elasticsearch_version
|
|
968
|
+
|
|
969
|
+
This parameter changes that ES plugin assumes default Elasticsearch version. The default value is `5`.
|
|
970
|
+
|
|
971
|
+
### custom_headers
|
|
972
|
+
|
|
973
|
+
This parameter adds additional headers to request. The default value is `{}`.
|
|
974
|
+
|
|
975
|
+
```
|
|
976
|
+
custom_headers {"token":"secret"}
|
|
977
|
+
```
|
|
978
|
+
|
|
979
|
+
### Not seeing a config you need?
|
|
980
|
+
|
|
981
|
+
We try to keep the scope of this plugin small and not add too many configuration options. If you think an option would be useful to others, feel free to open an issue or contribute a Pull Request.
|
|
982
|
+
|
|
983
|
+
Alternatively, consider using [fluent-plugin-forest](https://github.com/tagomoris/fluent-plugin-forest). For example, to configure multiple tags to be sent to different Elasticsearch indices:
|
|
984
|
+
|
|
985
|
+
```
|
|
986
|
+
<match my.logs.*>
|
|
987
|
+
@type forest
|
|
988
|
+
subtype elasticsearch
|
|
989
|
+
remove_prefix my.logs
|
|
990
|
+
<template>
|
|
991
|
+
logstash_prefix ${tag}
|
|
992
|
+
# ...
|
|
993
|
+
</template>
|
|
994
|
+
</match>
|
|
995
|
+
```
|
|
996
|
+
|
|
997
|
+
And yet another option is described in Dynamic Configuration section.
|
|
998
|
+
|
|
999
|
+
**Note**: If you use or evaluate Fluentd v0.14, you can use builtin placeholders. In more detail, please refer to [Placeholders](#placeholders) section.
|
|
1000
|
+
|
|
1001
|
+
### Dynamic configuration
|
|
1002
|
+
|
|
1003
|
+
If you want configurations to depend on information in messages, you can use `elasticsearch_dynamic`. This is an experimental variation of the Elasticsearch plugin allows configuration values to be specified in ways such as the below:
|
|
1004
|
+
|
|
1005
|
+
```
|
|
1006
|
+
<match my.logs.*>
|
|
1007
|
+
@type elasticsearch_dynamic
|
|
1008
|
+
hosts ${record['host1']}:9200,${record['host2']}:9200
|
|
1009
|
+
index_name my_index.${Time.at(time).getutc.strftime(@logstash_dateformat)}
|
|
1010
|
+
logstash_prefix ${tag_parts[3]}
|
|
1011
|
+
port ${9200+rand(4)}
|
|
1012
|
+
index_name ${tag_parts[2]}-${Time.at(time).getutc.strftime(@logstash_dateformat)}
|
|
1013
|
+
</match>
|
|
1014
|
+
```
|
|
1015
|
+
|
|
1016
|
+
**Please note, this uses Ruby's `eval` for every message, so there are performance and security implications.**
|
|
1017
|
+
|
|
1018
|
+
### Placeholders
|
|
1019
|
+
|
|
1020
|
+
v0.14 placeholders can handle `${tag}` for tag, `%Y%m%d` like strftime format, and custom record keys like as `record["mykey"]`.
|
|
1021
|
+
|
|
1022
|
+
Note that custom chunk key is different notations for `record_reformer` and `record_modifier`.
|
|
1023
|
+
They uses `record["some_key"]` to specify placeholders, but this feature uses `${key1}`, `${key2}` notation. And tag, time, and some arbitrary keys must be included in buffer directive attributes.
|
|
1024
|
+
|
|
1025
|
+
They are used as below:
|
|
1026
|
+
|
|
1027
|
+
#### tag
|
|
1028
|
+
|
|
1029
|
+
```aconf
|
|
1030
|
+
<match my.logs>
|
|
1031
|
+
@type elasticsearch
|
|
1032
|
+
index_name elastic.${tag} #=> replaced with each event's tag. e.g.) elastic.test.tag
|
|
1033
|
+
<buffer tag>
|
|
1034
|
+
@type memory
|
|
1035
|
+
</buffer>
|
|
1036
|
+
# <snip>
|
|
1037
|
+
</match>
|
|
1038
|
+
```
|
|
1039
|
+
|
|
1040
|
+
#### time
|
|
1041
|
+
|
|
1042
|
+
```aconf
|
|
1043
|
+
<match my.logs>
|
|
1044
|
+
@type elasticsearch
|
|
1045
|
+
index_name elastic.%Y%m%d #=> e.g.) elastic.20170811
|
|
1046
|
+
<buffer tag, time>
|
|
1047
|
+
@type memory
|
|
1048
|
+
timekey 3600
|
|
1049
|
+
</buffer>
|
|
1050
|
+
# <snip>
|
|
1051
|
+
</match>
|
|
1052
|
+
```
|
|
1053
|
+
|
|
1054
|
+
#### custom key
|
|
1055
|
+
|
|
1056
|
+
```log
|
|
1057
|
+
records = {key1: "value1", key2: "value2"}
|
|
1058
|
+
```
|
|
1059
|
+
|
|
1060
|
+
```aconf
|
|
1061
|
+
<match my.logs>
|
|
1062
|
+
@type elasticsearch
|
|
1063
|
+
index_name elastic.${key1}.${key2} # => e.g.) elastic.value1.value2
|
|
1064
|
+
<buffer tag, key1, key2>
|
|
1065
|
+
@type memory
|
|
1066
|
+
</buffer>
|
|
1067
|
+
# <snip>
|
|
1068
|
+
</match>
|
|
1069
|
+
```
|
|
1070
|
+
|
|
1071
|
+
## Multi workers
|
|
1072
|
+
|
|
1073
|
+
Since Fluentd v0.14, multi workers feature had been implemented to increase throughput with multiple processes. This feature allows Fluentd processes to use one or more CPUs. This feature will be enabled by the following system configuration:
|
|
1074
|
+
|
|
1075
|
+
```
|
|
1076
|
+
<system>
|
|
1077
|
+
workers N # where N is a natural number (N >= 1).
|
|
1078
|
+
</system>
|
|
1079
|
+
```
|
|
1080
|
+
|
|
1081
|
+
## log_es_400_reason
|
|
1082
|
+
|
|
1083
|
+
By default, the error logger won't record the reason for a 400 error from the Elasticsearch API unless you set log_level to debug. However, this results in a lot of log spam, which isn't desirable if all you want is the 400 error reasons. You can set this `true` to capture the 400 error reasons without all the other debug logs.
|
|
1084
|
+
|
|
1085
|
+
Default value is `false`.
|
|
1086
|
+
|
|
1087
|
+
## suppress_doc_wrap
|
|
1088
|
+
|
|
1089
|
+
By default, record body is wrapped by 'doc'. This behavior can not handle update script requests. You can set this to suppress doc wrapping and allow record body to be untouched.
|
|
1090
|
+
|
|
1091
|
+
Default value is `false`.
|
|
1092
|
+
|
|
1093
|
+
## ignore_exceptions
|
|
1094
|
+
|
|
1095
|
+
A list of exception that will be ignored - when the exception occurs the chunk will be discarded and the buffer retry mechanism won't be called. It is possible also to specify classes at higher level in the hierarchy. For example
|
|
1096
|
+
|
|
1097
|
+
```
|
|
1098
|
+
ignore_exceptions ["Elasticsearch::Transport::Transport::ServerError"]
|
|
1099
|
+
```
|
|
1100
|
+
|
|
1101
|
+
will match all subclasses of `ServerError` - `Elasticsearch::Transport::Transport::Errors::BadRequest`, `Elasticsearch::Transport::Transport::Errors::ServiceUnavailable`, etc.
|
|
1102
|
+
|
|
1103
|
+
Default value is empty list (no exception is ignored).
|
|
1104
|
+
|
|
1105
|
+
## exception_backup
|
|
1106
|
+
|
|
1107
|
+
Indicates whether to backup chunk when ignore exception occurs.
|
|
1108
|
+
|
|
1109
|
+
Default value is `true`.
|
|
1110
|
+
|
|
1111
|
+
## bulk_message_request_threshold
|
|
1112
|
+
|
|
1113
|
+
Configure `bulk_message` request splitting threshold size.
|
|
1114
|
+
|
|
1115
|
+
Default value is `20MB`. (20 * 1024 * 1024)
|
|
1116
|
+
|
|
1117
|
+
If you specify this size as negative number, `bulk_message` request splitting feature will be disabled.
|
|
1118
|
+
|
|
1119
|
+
## Troubleshooting
|
|
1120
|
+
|
|
1121
|
+
### Cannot send events to Elasticsearch
|
|
1122
|
+
|
|
1123
|
+
A common cause of failure is that you are trying to connect to an Elasticsearch instance with an incompatible version.
|
|
1124
|
+
|
|
1125
|
+
For example, td-agent currently bundles the 6.x series of the [elasticsearch-ruby](https://github.com/elastic/elasticsearch-ruby) library. This means that your Elasticsearch server also needs to be 6.x. You can check the actual version of the client library installed on your system by executing the following command.
|
|
1126
|
+
|
|
1127
|
+
```
|
|
1128
|
+
# For td-agent users
|
|
1129
|
+
$ /usr/sbin/td-agent-gem list elasticsearch
|
|
1130
|
+
# For standalone Fluentd users
|
|
1131
|
+
$ fluent-gem list elasticsearch
|
|
1132
|
+
```
|
|
1133
|
+
Or, fluent-plugin-elasticsearch v2.11.7 or later, users can inspect version incompatibility with the `validate_client_version` option:
|
|
1134
|
+
|
|
1135
|
+
```
|
|
1136
|
+
validate_client_version true
|
|
1137
|
+
```
|
|
1138
|
+
|
|
1139
|
+
If you get the following error message, please consider to install compatible elasticsearch client gems:
|
|
1140
|
+
|
|
1141
|
+
```
|
|
1142
|
+
Detected ES 5 but you use ES client 6.1.0.
|
|
1143
|
+
Please consider to use 5.x series ES client.
|
|
1144
|
+
```
|
|
1145
|
+
|
|
1146
|
+
For further details of the version compatibility issue, please read [the official manual](https://github.com/elastic/elasticsearch-ruby#compatibility).
|
|
1147
|
+
|
|
1148
|
+
### Cannot see detailed failure log
|
|
1149
|
+
|
|
1150
|
+
A common cause of failure is that you are trying to connect to an Elasticsearch instance with an incompatible ssl protocol version.
|
|
1151
|
+
|
|
1152
|
+
For example, `out_elasticsearch` set up ssl_version to TLSv1 due to historical reason.
|
|
1153
|
+
Modern Elasticsearch ecosystem requests to communicate with TLS v1.2 or later.
|
|
1154
|
+
But, in this case, `out_elasticsearch` conceals transporter part failure log by default.
|
|
1155
|
+
If you want to acquire transporter log, please consider to set the following configuration:
|
|
1156
|
+
|
|
1157
|
+
```
|
|
1158
|
+
with_transporter_log true
|
|
1159
|
+
@log_level debug
|
|
1160
|
+
```
|
|
1161
|
+
|
|
1162
|
+
Then, the following log is shown in Fluentd log:
|
|
1163
|
+
|
|
1164
|
+
```
|
|
1165
|
+
2018-10-24 10:00:00 +0900 [error]: #0 [Faraday::ConnectionFailed] SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: unknown protocol (OpenSSL::SSL::SSLError) {:host=>"elasticsearch-host", :port=>80, :scheme=>"https", :user=>"elastic", :password=>"changeme", :protocol=>"https"}
|
|
1166
|
+
```
|
|
1167
|
+
|
|
1168
|
+
This indicates that inappropriate TLS protocol version is used.
|
|
1169
|
+
If you want to use TLS v1.2, please use `ssl_version` parameter like as:
|
|
1170
|
+
|
|
1171
|
+
```
|
|
1172
|
+
ssl_version TLSv1_2
|
|
1173
|
+
```
|
|
1174
|
+
|
|
1175
|
+
### Cannot connect TLS enabled reverse Proxy
|
|
1176
|
+
|
|
1177
|
+
A common cause of failure is that you are trying to connect to an Elasticsearch instance behind nginx reverse proxy which uses an incompatible ssl protocol version.
|
|
1178
|
+
|
|
1179
|
+
For example, `out_elasticsearch` set up ssl_version to TLSv1 due to historical reason.
|
|
1180
|
+
Nowadays, nginx reverse proxy uses TLS v1.2 or later for security reason.
|
|
1181
|
+
But, in this case, `out_elasticsearch` conceals transporter part failure log by default.
|
|
1182
|
+
|
|
1183
|
+
If you set up nginx reverse proxy with TLS v1.2:
|
|
1184
|
+
|
|
1185
|
+
```
|
|
1186
|
+
server {
|
|
1187
|
+
listen <your IP address>:9400;
|
|
1188
|
+
server_name <ES-Host>;
|
|
1189
|
+
ssl on;
|
|
1190
|
+
ssl_certificate /etc/ssl/certs/server-bundle.pem;
|
|
1191
|
+
ssl_certificate_key /etc/ssl/private/server-key.pem;
|
|
1192
|
+
ssl_client_certificate /etc/ssl/certs/ca.pem;
|
|
1193
|
+
ssl_verify_client on;
|
|
1194
|
+
ssl_verify_depth 2;
|
|
1195
|
+
|
|
1196
|
+
# Reference : https://cipherli.st/
|
|
1197
|
+
ssl_protocols TLSv1.2;
|
|
1198
|
+
ssl_prefer_server_ciphers on;
|
|
1199
|
+
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
|
|
1200
|
+
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
|
|
1201
|
+
ssl_session_cache shared:SSL:10m;
|
|
1202
|
+
ssl_session_tickets off; # Requires nginx >= 1.5.9
|
|
1203
|
+
ssl_stapling on; # Requires nginx >= 1.3.7
|
|
1204
|
+
ssl_stapling_verify on; # Requires nginx => 1.3.7
|
|
1205
|
+
resolver 127.0.0.1 valid=300s;
|
|
1206
|
+
resolver_timeout 5s;
|
|
1207
|
+
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
|
1208
|
+
add_header X-Frame-Options DENY;
|
|
1209
|
+
add_header X-Content-Type-Options nosniff;
|
|
1210
|
+
|
|
1211
|
+
client_max_body_size 64M;
|
|
1212
|
+
keepalive_timeout 5;
|
|
1213
|
+
|
|
1214
|
+
location / {
|
|
1215
|
+
proxy_set_header Host $host;
|
|
1216
|
+
proxy_set_header X-Real-IP $remote_addr;
|
|
1217
|
+
proxy_pass http://localhost:9200;
|
|
1218
|
+
}
|
|
1219
|
+
}
|
|
1220
|
+
```
|
|
1221
|
+
|
|
1222
|
+
Then, nginx reverse proxy starts with TLSv1.2.
|
|
1223
|
+
|
|
1224
|
+
Fluentd suddenly dies with the following log:
|
|
1225
|
+
```
|
|
1226
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: log writing failed. execution expired
|
|
1227
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/ssl_socket.rb:10:in `initialize': stack level too deep (SystemStackError)
|
|
1228
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/connection.rb:429:in `new'
|
|
1229
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/connection.rb:429:in `socket'
|
|
1230
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/connection.rb:111:in `request_call'
|
|
1231
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/middlewares/mock.rb:48:in `request_call'
|
|
1232
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/middlewares/instrumentor.rb:26:in `request_call'
|
|
1233
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/middlewares/base.rb:16:in `request_call'
|
|
1234
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/middlewares/base.rb:16:in `request_call'
|
|
1235
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/excon-0.62.0/lib/excon/middlewares/base.rb:16:in `request_call'
|
|
1236
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: ... 9266 levels...
|
|
1237
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
|
|
1238
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.2.5/bin/fluentd:8:in `<top (required)>'
|
|
1239
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/bin/fluentd:22:in `load'
|
|
1240
|
+
Oct 31 9:44:45 <ES-Host> fluentd[6442]: from /opt/fluentd/embedded/bin/fluentd:22:in `<main>'
|
|
1241
|
+
Oct 31 9:44:45 <ES-Host> systemd[1]: fluentd.service: Control process exited, code=exited status=1
|
|
1242
|
+
```
|
|
1243
|
+
|
|
1244
|
+
If you want to acquire transporter log, please consider to set the following configuration:
|
|
1245
|
+
|
|
1246
|
+
```
|
|
1247
|
+
with_transporter_log true
|
|
1248
|
+
@log_level debug
|
|
1249
|
+
```
|
|
1250
|
+
|
|
1251
|
+
Then, the following log is shown in Fluentd log:
|
|
1252
|
+
|
|
1253
|
+
```
|
|
1254
|
+
2018-10-31 10:00:57 +0900 [warn]: #7 [Faraday::ConnectionFailed] Attempt 2 connecting to {:host=>"<ES-Host>", :port=>9400, :scheme=>"https", :protocol=>"https"}
|
|
1255
|
+
2018-10-31 10:00:57 +0900 [error]: #7 [Faraday::ConnectionFailed] Connection reset by peer - SSL_connect (Errno::ECONNRESET) {:host=>"<ES-Host>", :port=>9400, :scheme=>"https", :protocol=>"https"}
|
|
1256
|
+
```
|
|
1257
|
+
|
|
1258
|
+
The above logs indicates that using incompatible SSL/TLS version between fluent-plugin-elasticsearch and nginx, which is reverse proxy, is root cause of this issue.
|
|
1259
|
+
|
|
1260
|
+
If you want to use TLS v1.2, please use `ssl_version` parameter like as:
|
|
1261
|
+
|
|
1262
|
+
```
|
|
1263
|
+
ssl_version TLSv1_2
|
|
1264
|
+
```
|
|
1265
|
+
|
|
1266
|
+
### Declined logs are resubmitted forever, why?
|
|
1267
|
+
|
|
1268
|
+
Sometimes users write Fluentd configuration like this:
|
|
1269
|
+
|
|
1270
|
+
```aconf
|
|
1271
|
+
<match **>
|
|
1272
|
+
@type elasticsearch
|
|
1273
|
+
host localhost
|
|
1274
|
+
port 9200
|
|
1275
|
+
type_name fluentd
|
|
1276
|
+
logstash_format true
|
|
1277
|
+
time_key @timestamp
|
|
1278
|
+
include_timestamp true
|
|
1279
|
+
reconnect_on_error true
|
|
1280
|
+
reload_on_failure true
|
|
1281
|
+
reload_connections false
|
|
1282
|
+
request_timeout 120s
|
|
1283
|
+
</match>
|
|
1284
|
+
```
|
|
1285
|
+
|
|
1286
|
+
The above configuration does not use [`@label` feature](https://docs.fluentd.org/v1.0/articles/config-file#(5)-group-filter-and-output:-the-%E2%80%9Clabel%E2%80%9D-directive) and use glob(**) pattern.
|
|
1287
|
+
It is usually problematic configuration.
|
|
1288
|
+
|
|
1289
|
+
In error scenario, error events will be emitted with `@ERROR` label, and `fluent.*` tag.
|
|
1290
|
+
The black hole glob pattern resubmits a problematic event into pushing Elasticsearch pipeline.
|
|
1291
|
+
|
|
1292
|
+
This situation causes flood of declined log:
|
|
1293
|
+
|
|
1294
|
+
```log
|
|
1295
|
+
2018-11-13 11:16:27 +0000 [warn]: #0 dump an error event: error_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error="400 - Rejected by Elasticsearch" location=nil tag="app.fluentcat" time=2018-11-13 11:16:17.492985640 +0000 record={"message"=>"\xFF\xAD"}
|
|
1296
|
+
2018-11-13 11:16:38 +0000 [warn]: #0 dump an error event: error_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error="400 - Rejected by Elasticsearch" location=nil tag="fluent.warn" time=2018-11-13 11:16:27.978851140 +0000 record={"error"=>"#<Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError: 400 - Rejected by Elasticsearch>", "location"=>nil, "tag"=>"app.fluentcat", "time"=>2018-11-13 11:16:17.492985640 +0000, "record"=>{"message"=>"\xFF\xAD"}, "message"=>"dump an error event: error_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error=\"400 - Rejected by Elasticsearch\" location=nil tag=\"app.fluentcat\" time=2018-11-13 11:16:17.492985640 +0000 record={\"message\"=>\"\\xFF\\xAD\"}"}
|
|
1297
|
+
```
|
|
1298
|
+
|
|
1299
|
+
Then, user should use more concrete tag route or use `@label`.
|
|
1300
|
+
The following sections show two examples how to solve flood of declined log.
|
|
1301
|
+
One is using concrete tag routing, the other is using label routing.
|
|
1302
|
+
|
|
1303
|
+
#### Using concrete tag routing
|
|
1304
|
+
|
|
1305
|
+
The following configuration uses concrete tag route:
|
|
1306
|
+
|
|
1307
|
+
```aconf
|
|
1308
|
+
<match out.elasticsearch.**>
|
|
1309
|
+
@type elasticsearch
|
|
1310
|
+
host localhost
|
|
1311
|
+
port 9200
|
|
1312
|
+
type_name fluentd
|
|
1313
|
+
logstash_format true
|
|
1314
|
+
time_key @timestamp
|
|
1315
|
+
include_timestamp true
|
|
1316
|
+
reconnect_on_error true
|
|
1317
|
+
reload_on_failure true
|
|
1318
|
+
reload_connections false
|
|
1319
|
+
request_timeout 120s
|
|
1320
|
+
</match>
|
|
1321
|
+
```
|
|
1322
|
+
|
|
1323
|
+
#### Using label feature
|
|
1324
|
+
|
|
1325
|
+
The following configuration uses label:
|
|
1326
|
+
|
|
1327
|
+
```aconf
|
|
1328
|
+
<source>
|
|
1329
|
+
@type forward
|
|
1330
|
+
@label @ES
|
|
1331
|
+
</source>
|
|
1332
|
+
<label @ES>
|
|
1333
|
+
<match out.elasticsearch.**>
|
|
1334
|
+
@type elasticsearch
|
|
1335
|
+
host localhost
|
|
1336
|
+
port 9200
|
|
1337
|
+
type_name fluentd
|
|
1338
|
+
logstash_format true
|
|
1339
|
+
time_key @timestamp
|
|
1340
|
+
include_timestamp true
|
|
1341
|
+
reconnect_on_error true
|
|
1342
|
+
reload_on_failure true
|
|
1343
|
+
reload_connections false
|
|
1344
|
+
request_timeout 120s
|
|
1345
|
+
</match>
|
|
1346
|
+
</label>
|
|
1347
|
+
<label @ERROR>
|
|
1348
|
+
<match **>
|
|
1349
|
+
@type stdout
|
|
1350
|
+
</match>
|
|
1351
|
+
</label>
|
|
1352
|
+
```
|
|
1353
|
+
|
|
1354
|
+
### Suggested to increase flush_thread_count, why?
|
|
1355
|
+
|
|
1356
|
+
fluent-plugin-elasticsearch default behavior has a possibility to cause events traffic jam.
|
|
1357
|
+
When users use `flush_thread_count` = 1, ES plugin retries to send events if connection errors are disappeared.
|
|
1358
|
+
|
|
1359
|
+
To prevent the following warning and sending events blocking, you must specify `flush_thread_count` >= 2:
|
|
1360
|
+
|
|
1361
|
+
```log
|
|
1362
|
+
2018-12-24 14:32:06 +0900 [warn]: #0 To prevent events traffic jam, you should specify 2 or more 'flush_thread_count'.
|
|
1363
|
+
```
|
|
1364
|
+
|
|
1365
|
+
```aconf
|
|
1366
|
+
<match out.elasticsearch.**>
|
|
1367
|
+
@type elasticsearch
|
|
1368
|
+
host localhost
|
|
1369
|
+
port 9200
|
|
1370
|
+
# ...
|
|
1371
|
+
<buffer tag>
|
|
1372
|
+
@type memory # or file
|
|
1373
|
+
flush_thread_count 4
|
|
1374
|
+
</buffer>
|
|
1375
|
+
</match>
|
|
1376
|
+
```
|
|
1377
|
+
|
|
1378
|
+
### Suggested to install typhoeus gem, why?
|
|
1379
|
+
|
|
1380
|
+
fluent-plugin-elasticsearch doesn't depend on typhoeus gem by default.
|
|
1381
|
+
If you want to use typhoeus backend, you must install typhoeus gem by your own.
|
|
1382
|
+
|
|
1383
|
+
If you use vanilla Fluentd, you can install it by:
|
|
1384
|
+
|
|
1385
|
+
```
|
|
1386
|
+
gem install typhoeus
|
|
1387
|
+
```
|
|
1388
|
+
|
|
1389
|
+
But, you use td-agent instead of vanilla Fluentd, you have to use `td-agent-gem`:
|
|
1390
|
+
|
|
1391
|
+
```
|
|
1392
|
+
td-agent-gem install typhoeus
|
|
1393
|
+
```
|
|
1394
|
+
|
|
1395
|
+
In more detail, please refer to [the official plugin management document](https://docs.fluentd.org/v1.0/articles/plugin-management).
|
|
1396
|
+
|
|
1397
|
+
### Stopped to send events on k8s, why?
|
|
1398
|
+
|
|
1399
|
+
fluent-plugin-elasticsearch reloads connection after 10000 requests. (Not correspond to events counts because ES plugin uses bulk API.)
|
|
1400
|
+
|
|
1401
|
+
This functionality which is originated from elasticsearch-ruby gem is enabled by default.
|
|
1402
|
+
|
|
1403
|
+
Sometimes this reloading functionality bothers users to send events with ES plugin.
|
|
1404
|
+
|
|
1405
|
+
On k8s platform, users sometimes shall specify the following settings:
|
|
1406
|
+
|
|
1407
|
+
```aconf
|
|
1408
|
+
reload_connections false
|
|
1409
|
+
reconnect_on_error true
|
|
1410
|
+
reload_on_failure true
|
|
1411
|
+
```
|
|
1412
|
+
|
|
1413
|
+
If you use [fluentd-kubernetes-daemonset](https://github.com/fluent/fluentd-kubernetes-daemonset), you can specify them with environment variables:
|
|
1414
|
+
|
|
1415
|
+
* `FLUENT_ELASTICSEARCH_RELOAD_CONNECTIONS` as `false`
|
|
1416
|
+
* `FLUENT_ELASTICSEARCH_RECONNECT_ON_ERROR` as `true`
|
|
1417
|
+
* `FLUENT_ELASTICSEARCH_RELOAD_ON_FAILURE` as `true`
|
|
1418
|
+
|
|
1419
|
+
This issue had been reported at [#525](https://github.com/uken/fluent-plugin-elasticsearch/issues/525).
|
|
1420
|
+
|
|
1421
|
+
### Random 400 - Rejected by Elasticsearch is occured, why?
|
|
1422
|
+
|
|
1423
|
+
Index templates installed Elasticsearch sometimes generates 400 - Rejected by Elasticsearch errors.
|
|
1424
|
+
For example, kubernetes audit log has structure:
|
|
1425
|
+
|
|
1426
|
+
```json
|
|
1427
|
+
"responseObject":{
|
|
1428
|
+
"kind":"SubjectAccessReview",
|
|
1429
|
+
"apiVersion":"authorization.k8s.io/v1beta1",
|
|
1430
|
+
"metadata":{
|
|
1431
|
+
"creationTimestamp":null
|
|
1432
|
+
},
|
|
1433
|
+
"spec":{
|
|
1434
|
+
"nonResourceAttributes":{
|
|
1435
|
+
"path":"/",
|
|
1436
|
+
"verb":"get"
|
|
1437
|
+
},
|
|
1438
|
+
"user":"system:anonymous",
|
|
1439
|
+
"group":[
|
|
1440
|
+
"system:unauthenticated"
|
|
1441
|
+
]
|
|
1442
|
+
},
|
|
1443
|
+
"status":{
|
|
1444
|
+
"allowed":true,
|
|
1445
|
+
"reason":"RBAC: allowed by ClusterRoleBinding \"cluster-system-anonymous\" of ClusterRole \"cluster-admin\" to User \"system:anonymous\""
|
|
1446
|
+
}
|
|
1447
|
+
},
|
|
1448
|
+
```
|
|
1449
|
+
|
|
1450
|
+
The last element `status` sometimes becomes `"status":"Success"`.
|
|
1451
|
+
This element type glich causes status 400 error.
|
|
1452
|
+
|
|
1453
|
+
There are some solutions for fixing this:
|
|
1454
|
+
|
|
1455
|
+
#### Solution 1
|
|
1456
|
+
|
|
1457
|
+
For a key which causes element type glich case.
|
|
1458
|
+
|
|
1459
|
+
Using dymanic mapping with the following template:
|
|
1460
|
+
|
|
1461
|
+
```json
|
|
1462
|
+
{
|
|
1463
|
+
"template": "YOURINDEXNAME-*",
|
|
1464
|
+
"mappings": {
|
|
1465
|
+
"fluentd": {
|
|
1466
|
+
"dynamic_templates": [
|
|
1467
|
+
{
|
|
1468
|
+
"default_no_index": {
|
|
1469
|
+
"path_match": "^.*$",
|
|
1470
|
+
"path_unmatch": "^(@timestamp|auditID|level|stage|requestURI|sourceIPs|metadata|objectRef|user|verb)(\\..+)?$",
|
|
1471
|
+
"match_pattern": "regex",
|
|
1472
|
+
"mapping": {
|
|
1473
|
+
"index": false,
|
|
1474
|
+
"enabled": false
|
|
1475
|
+
}
|
|
1476
|
+
}
|
|
1477
|
+
}
|
|
1478
|
+
]
|
|
1479
|
+
}
|
|
1480
|
+
}
|
|
1481
|
+
}
|
|
1482
|
+
```
|
|
1483
|
+
|
|
1484
|
+
Note that `YOURINDEXNAME` should be replaced with your using index prefix.
|
|
1485
|
+
|
|
1486
|
+
#### Solution 2
|
|
1487
|
+
|
|
1488
|
+
For unstable `responseObject` and `requestObject` key existence case.
|
|
1489
|
+
|
|
1490
|
+
```aconf
|
|
1491
|
+
<filter YOURROUTETAG>
|
|
1492
|
+
@id kube_api_audit_normalize
|
|
1493
|
+
@type record_transformer
|
|
1494
|
+
auto_typecast false
|
|
1495
|
+
enable_ruby true
|
|
1496
|
+
<record>
|
|
1497
|
+
host "#{ENV['K8S_NODE_NAME']}"
|
|
1498
|
+
responseObject ${record["responseObject"].nil? ? "none": record["responseObject"].to_json}
|
|
1499
|
+
requestObject ${record["requestObject"].nil? ? "none": record["requestObject"].to_json}
|
|
1500
|
+
origin kubernetes-api-audit
|
|
1501
|
+
</record>
|
|
1502
|
+
</filter>
|
|
1503
|
+
```
|
|
1504
|
+
|
|
1505
|
+
Normalize `responseObject` and `requestObject` key with record_transformer and other similiar plugins is needed.
|
|
1506
|
+
|
|
1507
|
+
### Fluentd seems to hang if it unable to connect Elasticsearch, why?
|
|
1508
|
+
|
|
1509
|
+
On `#configure` phase, ES plugin should wait until ES instance communication is succeeded.
|
|
1510
|
+
And ES plugin blocks to launch Fluentd by default.
|
|
1511
|
+
Because Fluentd requests to set up configuration correctly on `#configure` phase.
|
|
1512
|
+
|
|
1513
|
+
After `#configure` phase, it runs very fast and send events heavily in some heavily using case.
|
|
1514
|
+
|
|
1515
|
+
In this scenario, we need to set up configuration correctly until `#configure` phase.
|
|
1516
|
+
So, we provide default parameter is too conservative to use advanced users.
|
|
1517
|
+
|
|
1518
|
+
To remove too pessimistic behavior, you can use the following configuration:
|
|
1519
|
+
|
|
1520
|
+
```aconf
|
|
1521
|
+
<match **>
|
|
1522
|
+
@type elasticsearch
|
|
1523
|
+
# Some advanced users know their using ES version.
|
|
1524
|
+
# We can disable startup ES version checking.
|
|
1525
|
+
verify_es_version_at_startup false
|
|
1526
|
+
# If you know that your using ES major version is 7, you can set as 7 here.
|
|
1527
|
+
default_elasticsearch_version 7
|
|
1528
|
+
# If using very stable ES cluster, you can reduce retry operation counts. (minmum is 1)
|
|
1529
|
+
max_retry_get_es_version 1
|
|
1530
|
+
# If using very stable ES cluster, you can reduce retry operation counts. (minmum is 1)
|
|
1531
|
+
max_retry_putting_template 1
|
|
1532
|
+
# ... and some ES plugin configuration
|
|
1533
|
+
</match>
|
|
1534
|
+
```
|
|
1535
|
+
|
|
1536
|
+
## Contact
|
|
1537
|
+
|
|
1538
|
+
If you have a question, [open an Issue](https://github.com/uken/fluent-plugin-elasticsearch/issues).
|
|
1539
|
+
|
|
1540
|
+
## Contributing
|
|
1541
|
+
|
|
1542
|
+
There are usually a few feature requests, tagged [Easy](https://github.com/uken/fluent-plugin-elasticsearch/issues?q=is%3Aissue+is%3Aopen+label%3Alevel%3AEasy), [Normal](https://github.com/uken/fluent-plugin-elasticsearch/issues?q=is%3Aissue+is%3Aopen+label%3Alevel%3ANormal) and [Hard](https://github.com/uken/fluent-plugin-elasticsearch/issues?q=is%3Aissue+is%3Aopen+label%3Alevel%3AHard). Feel free to work on any one of them.
|
|
1543
|
+
|
|
1544
|
+
Pull Requests are welcomed.
|
|
1545
|
+
|
|
1546
|
+
Becore send a pull request or report an issue, please read [the contribution guideline](CONTRIBUTING.md).
|
|
1547
|
+
|
|
1548
|
+
[](https://waffle.io/uken/fluent-plugin-elasticsearch/metrics)
|
|
1549
|
+
|
|
1550
|
+
## Running tests
|
|
1551
|
+
|
|
1552
|
+
Install dev dependencies:
|
|
1553
|
+
|
|
1554
|
+
```sh
|
|
1555
|
+
$ gem install bundler
|
|
1556
|
+
$ bundle install
|
|
1557
|
+
$ bundle exec rake test
|
|
1558
|
+
```
|