FLUENT_CONF. For example, /etc/td-agent/td-agent.conf is specified via FLUENT_CONF inside td-agent scripts.http and forward. http turns fluentd into an HTTP endpoint to accept incoming HTTP messages whereas forward turns fluentd into a TCP endpoint to accept TCP packets. Of course, it can be both at the same time (You can add as many sources as you wish)@type parameter. The @type parameter specifies which input plugin to use.source submits events into the Fluentd's routing engine. An event consists of three entities: tag, time and record. The tag is a string separated by '.'s (e.g. myapp.access), and is used as the directions for Fluentd's internal routing engine. The time field is specified by input plugins, and it must be in the Unix time format. The record is a JSON object. Fluentd accepts all non-period characters as a part of a tag. However, since the tag is sometimes used in a different context by output destinations (e.g., table name, database name, key name, etc.), it is strongly recommended that you stick to the lower-case alphabets, digits and underscore, e.g., ^[a-z0-9_]+$.file and forward. Let's add those to our configuration file.@type parameter. Only events with a tag matching the pattern will be sent to the output destination (in the above example, only the events with the tag "myapp.access" is matched. See the section below for more advanced usage). The @type parameter specifies the output plugin to use.record_transformer filter to "match" example.{"event":"data"}, goes to record_transformer filter first. record_transformer adds "host_param" field to event and filtered event, {"event":"data","host_param":"webserver1"}, goes to file output.ps command shows the following result:@ prefix is needed.forward events are routed to record_transformer filter / elasticsearch output and in_tail events are routed to grep filter / s3 output inside @SYSTEM label.@ERROR label is a built-in label used for error record emitted by plugin's emit_error_event API.<label @ERROR> in the configuration, events are routed to this label when emit related error, e.g. buffer is full or invalid record.a.conf and b.conf, fluentd parses a.conf first. But you should not write the configuration depends on this order. It is so error prone. Please separate @include for safety.<filter app.log>), there are a number of techniques you can use to manage the data flow more efficiently.<match> and <filter> tags.* matches a single tag part.a.* matches a.b, but does not matcha or a.b.c** matches zero or more tag parts.a.** matches a, a.b and a.b.c{X,Y,Z} matches X, Y, or Z, where X, Y, and Z are match patterns.{a,b} matches a and b, but does not match c* or ** patterns. Examples include a.{b,c}.* and a.{b,c.**}<match a b> match a and b.<match a.** b.*> match a, a.b, a.b.c (from the first pattern) and b.d (from the second pattern).myapp.access is never matched. Wider match patterns should be defined after tight match patterns.match is never matched. If you want to send events to multiple outputs, consider out_copy plugin.<filter> block after <match>. It will never work as supposed, since events never go through the filter for the reason explained above.rotate_wait and pos_file. Each parameter has a specific type associated with it. They are defined as follows:string type: the field is parsed as a string. This is the moststring has 3 literals, non-quoted one line string, ' quoted" quoted string.integer type: the field is parsed as an integer.float type: the field is parsed as a float.size type: the field is parsed as the number of bytes. There are<INTEGER>k or <INTEGER>K, then the<INTEGER>m or <INTEGER>M, then the<INTEGER>g or <INTEGER>G, then the<INTEGER>t or <INTEGER>T, then thetime type: the field is parsed as a time duration.<INTEGER>s, then the value is the INTEGER<INTEGER>m, then the value is the INTEGER<INTEGER>h, then the value is the INTEGER<INTEGER>d, then the value is the INTEGERarray type: the field is parsed as a JSON array. It also supports["key1", "key2"]key1,key2hash type: the field is parsed as a JSON object. It also supports{"key1":"value1", "key2":"value2"}key1:value1,key2:value2array and hash are JSON because almost all programming languages and infrastructure tools can generate JSON value easily than unusual format.@ prefix.@type: Specify plugin type@id: Specify plugin id. in_monitor_agent uses this value fortype, id and log_level are supported for backward compatibility.--dry-run option." quoted string, array and hash values.[ or { is a start of array / hash. So if you want to set [ or { started but non-json parameter, please use ' or ".#{} in " quoted string. This is useful for setting machine information like hostname.\ is escape character\ is interpreted as escape character. You need \ for setting ", \r, \n, \t, \ or several characters in double-quoted string literal.