file Output Plugin

The out_file TimeSliced Output plugin writes events to files. By default, it creates files on a daily basis (around 00:10). This means that when you first import records using the plugin, no file is created immediately. The file will be created when the time_slice_format condition has been met. To change the output frequency, please modify the time_slice_format value.

Table of Contents

Example Configuration

out_file is included in Fluentd’s core. No additional installation process is required.

<match pattern>
  @type file
  path /var/log/fluent/myapp
  time_slice_format %Y%m%d
  time_slice_wait 10m
  time_format %Y%m%dT%H%M%S%z
  compress gzip
  utc
</match>
Please see the Config File article for the basic structure and syntax of the configuration file.

Parameters

type (required)

The value must be file.

path (required)

The Path of the file. The actual path is path + time + ”.log”. The time portion is determined by the time_slice_format parameter, descried below.

The path parameter is used as buffer_path in this plugin.

Initially, you may see a file which looks like "/path/to/file.20140101.log.b4eea2c8166b147a0". This is an intermediate buffer file ("b4eea2c8166b147a0" identifies the buffer). Once the content of the buffer has been completely flushed, you will see the output file without the trailing identifier.

append

The flushed chunk is appended to existence file or not. The default is false. By default, out_file flushes each chunk to different path.

# append false
log.20140608_0.log
log.20140608_1.log
log.20140609_0.log
log.20140609_1.log

This makes parallel file processing easy. But if you want to disable this behaviour, you can disable it by setting append true.

# append true
log.20140608.log
log.20140609.log

format

The format of the file content. The default is out_file.

out_file

Output time, tag and json record separated by a delimiter:

time[delimiter]tag[delimiter]record\n

Example:

2014-06-08T23:59:40[TAB]file.server.logs[TAB]{"field1":"value1","field2":"value2"}\n

out_file format has several options to customize the format.

delimiter SPACE   # Optional, SPACE or COMMA. "\t"(TAB) is used by default
output_tag false  # Optional, defaults to true. Output the tag field if true.
output_time true  # Optional, defaults to true. Output the time field if true.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

json

Output a json record without the time or tag field:

{"field1":"value1","field2":"value2"}\n

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

hash

Output a record as ruby hash without the time or tag field:

{"field1"=>"value1","field2"=>"value2"}\n

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

ltsv

Output the record as LTSV:

field1[label_delimiter]value1[delimiter]field2[label_delimiter]value2\n

ltsv format supports delimiter and label_delimiter options.

format ltsv
delimiter SPACE   # Optional. "\t"(TAB) is used by default
label_delimiter = # Optional. ":" is used by default

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

single_value

Output the value of a single field instead of the whole record. Often used in conjunction with in_tail’s format none.

value1\n

single_value format supports the add_newline and message_key options.

add_newline false # Optional, defaults to true. If there is a trailing "\n" already, set it "false"
message_key my_field # Optional, defaults to "message". The value of this field is outputted.

csv

Output the record as CSV/TSV:

"value1"[delimiter]"value2"[delimiter]"value3"\n

csv format supports the delimiter and force_quotes options.

format csv
fields field1,field2,field3
delimiter \t   # Optional. "," is used by default.
force_quotes false # Optional. true is used by default. If false, value won't be framed by quotes.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

stdout

This format is aimed to be used by stdout plugins.

Output time, tag and formatted record as follows:

time tag: formatted_record\n

Example:

2015-05-02 12:12:17 +0900 tag: {"field1":"value1","field2":"value2"}\n

stdout format has a following option to customize the format of the record part.

output_type format # Optional, defaults to "json". The format of
`formatted_record`. Any formatter plugins can be specified.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, xOptional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+–]HH:MM (e.g. “+09:00”)
    2. [+–]HHMM (e.g. “+0900”)
    3. [+–]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

time_format

The format of the time written in files. The default format is ISO-8601.

utc

Uses UTC for path formatting. The default format is localtime.

compress

Compresses flushed files using gzip. No compression is performed by default.

symlink_path

Create symlink to temporary buffered file when buffer_type is file. No symlink is created by default. This is useful for tailing file content to check logs.

Time Sliced Output Parameters

For advanced usage, you can tune Fluentd’s internal buffering mechanism with these parameters.

time_slice_format

The time format used as part of the file name. The following characters are replaced with actual values when the file is created:

  • %Y: year including the century (at least 4 digits)
  • %m: month of the year (01..12)
  • %d: Day of the month (01..31)
  • %H: Hour of the day, 24-hour clock (00..23)
  • %M: Minute of the hour (00..59)
  • %S: Second of the minute (00..60)

The default format is %Y%m%d%H, which creates one file per hour.

time_slice_wait

The amount of time Fluentd will wait for old logs to arrive. This is used to account for delays in logs arriving to your Fluentd node. The default wait time is 10 minutes (‘10m’), where Fluentd will wait until 10 minutes past the hour for any logs that occurred within the past hour.

For example, when splitting files on an hourly basis, a log recorded at 1:59 but arriving at the Fluentd node between 2:00 and 2:10 will be uploaded together with all the other logs from 1:00 to 1:59 in one transaction, avoiding extra overhead. Larger values can be set as needed.

buffer_type

The buffer type is file by default (buf_file). The memory (buf_memory) buffer type can be chosen as well. If you use file buffer type, buffer_path parameter is required.

buffer_queue_limit, buffer_chunk_limit

The length of the chunk queue and the size of each chunk, respectively. Please see the Buffer Plugin Overview article for the basic buffer structure. The default values are 64 and 8m, respectively. The suffixes “k” (KB), “m” (MB), and “g” (GB) can be used for buffer_chunk_limit.

flush_interval

The interval between data flushes. The default is 60s. The suffixes “s” (seconds), “m” (minutes), and “h” (hours) can be used.

flush_at_shutdown

If set to true, Fluentd waits for the buffer to flush at shutdown. By default, it is set to true for Memory Buffer and false for File Buffer.

retry_wait, max_retry_wait

The initial and maximum intervals between write retries. The default values are 1.0 and unset (no limit). The interval doubles (with +/-12.5% randomness) every retry until max_retry_wait is reached. In the default configuration the last retry waits for approximately 131072 sec, roughly 36 hours.

retry_limit, disable_retry_limit

The limit on the number of retries before buffered data is discarded, and an option to disable that limit (if true, the value of retry_limit is ignored and there is no limit). The default values are 17 and false (not disabled). If the limit is reached, buffered data is discarded and the retry interval is reset to its initial value (retry_wait).

num_threads

The number of threads to flush the buffer. This option can be used to parallelize writes into the output(s) designated by the output plugin. The default is 1.

log_level option

The log_level option allows the user to set different levels of logging for each plugin. The supported log levels are: fatal, error, warn, info, debug, and trace.

Please see the logging article for further details.

Last updated: 2015-04-08 11:33:14 UTC

Available languages | en | ja |

If this article is incorrect or outdated, or omits critical information, please let us know.

Interested in the Fluentd Newsletters?