This article shows typical routing examples.
<source>@type forward</source>​<filter app.**>@type record_transformer<record>hostname "#{Socket.gethostname}"</record></filter>​<match app.**>@type file# ...</match>
<source>@type forward</source>​<source>@type tailtag system.logs# ...</source>​<filter app.**>@type record_transformer<record>hostname "#{Socket.gethostname}"</record></filter>​<match {app.**,system.logs}>@type file# ...</match>
If you want to separate data pipeline for each sources, use Label.
Label reduces complex tag handling by separating data pipeline.
<source>@type forward</source>​<source>@type dstat@label @METRICS # dstat events are routed to <label @METRICS># ...</source>​<filter app.**>@type record_transformer<record># ...</record></filter>​<match app.**>@type file# ...</match>​<label @METRICS><match **>@type elasticsearch# ...</match></label>
Use fluent-plugin-route plugin. route
plugin rewrites tag and re-emit events to other match or Label.
<match worker.**>@type routeremove_tag_prefix workeradd_tag_prefix metrics.event​<route **>copy # For fall-through. Without copy, routing is stopped here.</route><route **>copy@label @BACKUP</route></match>​<match metrics.event.**>@type stdout</match>​<label @BACKUP><match metrics.event.**>@type filepath /var/log/fluent/bakcup</match></label>
Use fluent-plugin-rewrite-tag-filter.
<source>@type forward</source>​# event example: app.logs {"message":"[info]: ..."}<match app.**>@type rewrite_tag_filterrewriterule1 message ^\[(\w+)\] $1.${tag}</match>​# send mail when receives alert level logs<match alert.app.**>@type mail# ...</match>​# other logs are stored into file<match *.app.**>@type file# ...</match>
See also out_rewrite_tag_filter article.
Use out_relabel plugin. relabel
plugin simply emits events to Label. No tag rewrite.
<source>@type forward</source>​<match app.**>@type copy<store>@type forward# ...</store><store>@type relabel@label @NOTIFICATION</store></match>​<label @NOTIFICATION><filter app.**>@type grepregexp1 message ERROR</filter>​<match app.**>@type mail</match></label>
If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.