The in_tcp Input plugin enables Fluentd to accept TCP payload.

Don't use this plugin for receiving logs from Fluentd client libraries. Use in_forward for such cases.

Example Configuration

in_tcp is included in Fluentd's core. No additional installation process is required.

<source>
  @type tcp
  tag tcp.events # required
  <parse>
    @type regexp
    expression /^(?<field1>\d+):(?<field2>\w+)$/
  </parse>
  port 20001   # optional. 5170 by default
  bind 0.0.0.0 # optional. 0.0.0.0 by default
  delimiter "\n" # optional. "\n" (newline) by default
</source>

Example input:

$ echo '123456:awesome' | netcat 0.0.0.0 5170

Parsed result like below:

{"field1":"123456","field2":"awesome"}

Please see the Config File article for the basic structure and syntax of the configuration file. For <parse> section, please check Parse section cofiguration.

We\'ve observed the drastic performance improvements on Linux, with proper kernel parameter settings. If you have high-volume TCP traffic, please make sure to follow the instruction described at Before Installing Fluentd.

Plugin helpers

• ​server​

• ​parser​

• ​extract​

• ​compat_parameters​

Parameters

​Common Parameters​

@type

The value must be tcp.

tag

tag of output events.

port

The port to listen to.

bind

The bind address to listen to.

source_hostname_key

The field name of the client's hostname. If set the value, the client's hostname will be set to its key. The default is nil (no adding hostname).

If you set following configuration:

source_hostname_key client_host

then the client's hostname is set to client_host field.

{
    ...
    "foo": "bar",
    "client_host": "client.hostname.org"
}

source_address_key

The field name for the client's IP address. If you set this option, Fluentd automatically adds the remote address to each data record.

For example, if you have the following configuration:

@type tcp source_address_key client_addr ...

you will get something like below:

:::text
{
    ...
    "client_addr": "192.168.10.10"
    ...
}

<transport> section

This section is for using TLS transport.

<transport tls>
  cert_path /path/to/fluentd.crt
  # other parameters
</transport>

Without <transport tls>, in_tcp uses raw TCP.

<security> section

Add <security>/<client> section to allow access by Host/IP/Network

<client> section

host

The IP address or host name of the client.

This is exclusive with network.

network

Network address specification.

This is exclusive with host.

<parse> section

in_tcp uses parser plugin to parse the payload.

For more details about parser plugin, see followings:

• ​Parser Plugin Overview​

• ​Parse section configurations​

Code example

Here is ruby example to send event to in_tcp.

require 'socket'
​
# This example uses json payload.
# In in_tcp configuration, need to configure "@type json" in "<parse>"
TCPSocket.open('127.0.0.1', 5170) do |s|
  s.write('{"k":"v1"}' + "\n")
  s.write('{"k":"v2"}' + "\n")
end

Tips

How to Enable TLS Encryption

in_tcp support TLS tranport. Here is configuration example.

<source>
  @type tcp
  port 5140
  bind 0.0.0.0
  <transport tls>
    ca_path /etc/pki/ca.pem
    cert_path /etc/pki/cert.pem
    private_key_path /etc/pki/key.pem
    private_key_passphrase PASSPHRASE
  </transport>
  tag tcp
</source>

How to Enable TLS Mutual Authentication

Fluentd supports TLS mutual authentication (a.k.a. client certificate auth). If you want to use this feature, please set the client_cert_auth and ca_path options as follows.

<source>
  @type tcp
  port 20001
  <transport tls>
    ...
    client_cert_auth true
    ca_path /path/to/ca/cert
  </transport>
</source>

When this feature is enabled, Fluentd will check all incoming requests for a client certificate signed by the trusted CA. Requests that don't supply a valid client certificate will fail.

To check if mutual authentication is working properly, issue the following command:

$ openssl s_client -connect localhost:20001 \
  -key path/to/client.key \
  -cert path/to/client.crt \
  -CAfile path/to/ca.crt

If the connection gets established successfully, your setup is working fine.

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.