This article shows configuration samples for typical routing scenarios.
<source>@type forward</source>​<filter app.**>@type record_transformer<record>hostname "#{Socket.gethostname}"</record></filter>​<match app.**>@type file# ...</match>
<source>@type forward</source>​<source>@type tailtag system.logs# ...</source>​<filter app.**>@type record_transformer<record>hostname "#{Socket.gethostname}"</record></filter>​<match {app.**,system.logs}>@type file# ...</match>
If you want to separate the data pipelines for each source, use Label.
Label reduces complex tag
handling by separating data pipelines.
<source>@type forward</source>​<source>@type dstat@label @METRICS # dstat events are routed to <label @METRICS># ...</source>​<filter app.**>@type record_transformer<record># ...</record></filter>​<match app.**>@type file# ...</match>​<label @METRICS><match **>@type elasticsearch# ...</match></label>
Use fluent-plugin-route plugin. This plugin rewrites tag
and re-emit events to other match
or Label.
<match worker.**>@type routeremove_tag_prefix workeradd_tag_prefix metrics.event​<route **>copy # For fall-through. Without copy, routing is stopped here.</route><route **>copy@label @BACKUP</route></match>​<match metrics.event.**>@type stdout</match>​<label @BACKUP><match metrics.event.**>@type filepath /var/log/fluent/backup</match></label>
Use fluent-plugin-rewrite-tag-filter.
<source>@type forward</source>​# event example: app.logs {"message":"[info]: ..."}<match app.**>@type rewrite_tag_filter<rule>key messagepattern ^\[(\w+)\]tag $1.${tag}</rule># more rules</match>​# send mail when receives alert level logs<match alert.app.**>@type mail# ...</match>​# other logs are stored into a file<match *.app.**>@type file# ...</match>
See also: out_rewrite_tag_filter​
Use out_relabel plugin. This plugin simply emits events to Label without rewriting the tag
.
<source>@type forward</source>​<match app.**>@type copy<store>@type forward# ...</store><store>@type relabel@label @NOTIFICATION</store></match>​<label @NOTIFICATION><filter app.**>@type grepregexp1 message ERROR</filter>​<match app.**>@type mail</match></label>
If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is an open-source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.