Fluentd
0.12
0.12
  • Introduction
  • Overview
    • Getting Started
    • Installation
    • Life of a Fluentd event
    • Support
    • FAQ
  • Use Cases
    • Centralized App Logging
    • Monitoring Service Logs
    • Data Analytics
    • Connecting to Data Storages
    • Stream Processing
    • Windows Event Collection
    • IoT Data Logger
  • Configuration
    • Config File Syntax
    • Routing Examples
    • Recipes
  • Deployment
    • Logging
    • Monitoring
    • Signals
    • RPC
    • High Availability Config
    • Failure Scenarios
    • Performance Tuning
    • Plugin Management
    • Trouble Shooting
    • Secure Forwarding
    • Fluentd UI
    • Command Line Option
  • Container Deployment
    • Docker Image
    • Docker Logging Driver
    • Docker Compose
    • Kubernetes
  • Input Plugins
    • tail
    • forward
    • secure_forward
    • udp
    • tcp
    • http
    • unix
    • syslog
    • exec
    • scribe
    • multiprocess
    • dummy
    • Others
  • Output Plugins
    • file
    • s3
    • kafka
    • forward
    • secure_forward
    • exec
    • exec_filter
    • copy
    • geoip
    • roundrobin
    • stdout
    • null
    • webhdfs
    • splunk
    • mongo
    • mongo_replset
    • relabel
    • rewrite_tag_filter
    • Others
  • Buffer Plugins
    • memory
    • file
  • Filter Plugins
    • record_transformer
    • grep
    • parser
    • stdout
  • Parser Plugins
    • regexp
    • apache2
    • apache_error
    • nginx
    • syslog
    • ltsv
    • csv
    • tsv
    • json
    • multiline
    • none
  • Formatter Plugins
    • out_file
    • json
    • ltsv
    • csv
    • msgpack
    • hash
    • single_value
  • Developer
    • Plugin Development
    • Community
    • Mailing List
    • Source Code
    • Bug Tracking
    • ChangeLog
    • Logo
  • Articles
    • Store Apache Logs into MongoDB
    • Apache To Riak
    • Store Apache Logs into Amazon S3
    • Before Install
    • Cep Norikra
    • Collect Glusterfs Logs
    • Common Log Formats
    • Docker Logging Efk Compose
    • Docker Logging
    • Filter Modify Apache
    • Forwarding Over Ssl
    • Free Alternative To Splunk By Fluentd
    • Data Collection to Hadoop (HDFS)
    • Data Analytics with Treasure Data
    • Install By Chef
    • Install By Deb
    • Install By Dmg
    • Install By Gem
    • Install By Rpm
    • Install From Source
    • Install On Beanstalk
    • Install On Heroku
    • Java
    • Kinesis Stream
    • Kubernetes Fluentd
    • Monitoring by Prometheus
    • Monitoring by Rest Api
    • Nodejs
    • Performance Tuning Multi Process
    • Performance Tuning Single Process
    • Perl
    • Php
    • Python
    • Quickstart
    • Raspberrypi Cloud Data Logger
    • Recipe Apache Logs To Elasticsearch
    • Recipe Apache Logs To Mongo
    • Recipe Apache Logs To S3
    • Recipe Apache Logs To Treasure Data
    • Recipe Cloudstack To Mongodb
    • Recipe Csv To Elasticsearch
    • Recipe Csv To Mongo
    • Recipe Csv To S3
    • Recipe Csv To Treasure Data
    • Recipe Http Rest Api To Elasticsearch
    • Recipe Http Rest Api To Mongo
    • Recipe Http Rest Api To S3
    • Recipe Http Rest Api To Treasure Data
    • Recipe Json To Elasticsearch
    • Recipe Json To Mongo
    • Recipe Json To S3
    • Recipe Json To Treasure Data
    • Recipe Nginx To Elasticsearch
    • Recipe Nginx To Mongo
    • Recipe Nginx To S3
    • Recipe Nginx To Treasure Data
    • Recipe Syslog To Elasticsearch
    • Recipe Syslog To Mongo
    • Recipe Syslog To S3
    • Recipe Syslog To Treasure Data
    • Recipe Tsv To Elasticsearch
    • Recipe Tsv To Mongo
    • Recipe Tsv To S3
    • Recipe Tsv To Treasure Data
    • Ruby
    • Scala
    • Splunk Like Grep And Alert Email
Powered by GitBook
On this page
  • Example Configuration
  • How it Works
  • Parameters
  • type (required)
  • tag (required)
  • path (required)
  • exclude_path
  • refresh_interval
  • limit_recently_modified
  • skip_refresh_on_startup
  • read_from_head
  • encoding, from_encoding
  • read_lines_limit
  • multiline_flush_interval
  • pos_file (highly recommended)
  • format (required)
  • path_key
  • rotate_wait
  • enable_watch_timer
  • ignore_repeated_permission_error
  • FAQ
  • in_tail doesn't start to read log file, why?
  • logrotate setting
  • What happens when in_tail receives BufferQueueLimitError?

Was this helpful?

  1. Input Plugins

tail

PreviousInput PluginsNextforward

Last updated 5 years ago

Was this helpful?

The in_tail Input plugin allows Fluentd to read events from the tail of text files. Its behavior is similar to the tail -F command.

Example Configuration

in_tail is included in Fluentd's core. No additional installation process is required.

<source>
  @type tail
  path /var/log/httpd-access.log
  pos_file /var/log/td-agent/httpd-access.log.pos
  tag apache.access
  format apache2
</source>

How it Works

  • When Fluentd is first configured with in_tail, it will start

    reading from the tail of that log, not the beginning.

  • Once the log is rotated, Fluentd starts reading the new file from

    the beginning. It keeps track of the current inode number.

  • If td-agent restarts, it starts reading from the last position

    td-agent read before the restart. This position is recorded in the

    position file specified by the pos_file parameter.

Parameters

type (required)

The value must be tail.

tag (required)

The tag of the event.

* can be used as a placeholder that expands to the actual file path, replacing '/' with '.'. For example, if you have the following configuration

path /path/to/file
tag foo.*

in_tail emits the parsed events with the 'foo.path.to.file' tag.

path (required)

The paths to read. Multiple paths can be specified, separated by ','.

* and strftime format can be included to add/remove watch file dynamically. At interval of refresh_interval, Fluentd refreshes the list of watch file.

path /path/to/%Y/%m/%d/*

If the date is 20140401, Fluentd starts to watch the files in /path/to/2014/04/01 directory. See also read_from_head parameter.

You should not use \'*\' with log rotation because it may cause the log duplication. In such case, you should separate in_tail plugin configuration.

exclude_path

The paths to exclude the files from watcher list. For example, if you want to remove compressed files, you can use following pattern.

path /path/to/*
exclude_path ["/path/to/*.gz", "/path/to/*.zip"]

refresh_interval

The interval of refreshing the list of watch file. Default is 60 seconds.

limit_recently_modified

This parameter is available since v0.12.33.

Limit the watching files that the modification time is within the specified time range when use * in path parameter.

skip_refresh_on_startup

This parameter is available since v0.12.33.

Skip the refresh of watching list on startup. This reduces the start up time when use * in path.

read_from_head

Start to read the logs from the head of file, not bottom. The default is false.

If you want to tail all contents with * or strftime dynamic path, set this parameter to true. Instead, you should guarantee that log rotation will not occur in * directory.

When this is true, in_tail tries to read a file during start up phase. If target file is large, it takes long time and starting other plugins isn't executed until reading file is finished.

encoding, from_encoding

Specify the encoding of reading lines. The default is ASCII-8BIT.

By default, in_tail emits string value as ASCII-8BIT encoding. These options change it.

  • If specify only encoding, in_tail changes string to encoding.

    This use ruby's

  • If specify encoding and from_encoding, in_tail tries to encode

    string from from_encoding to encoding. This uses ruby's

You can get supported encoding list by typing following command:

$ ruby -e 'p Encoding.name_list.sort'

read_lines_limit

The number of reading lines at each IO. Default is 1000 lines.

If you see "Size of the emitted data exceeds buffer_chunk_limit." log with in_tail, set smaller value.

multiline_flush_interval

The interval of flushing the buffer for multiline format. The default is disabled.

If you set multiline_flush_interval 5s, in_tail flushes buffered event after 5 seconds from last emit. This option is useful when you use format_firstline option. Since v0.12.20 or later.

pos_file (highly recommended)

This parameter is highly recommended. Fluentd will record the position it last read into this file.

pos_file /var/log/td-agent/tmp/access.log.pos

pos_file handles multiple positions in one file so no need multiple pos_file parameters per source.

Don't share pos_file between in_tail configurations. It causes unexpected behavior, e.g. corrupt pos_file content.

format (required)

path_key

Add watching file path to path_key field.

path /path/to/access.log
path_key tailed_path

With this config, generated events are like {"tailed_path":"/path/to/access.log","k1":"v1",...,"kN":"vN"}.

rotate_wait

in_tail actually does a bit more than tail -F itself. When rotating a file, some data may still need to be written to the old file as opposed to the new one.

in_tail takes care of this by keeping a reference to the old file (even after it has been rotated) for some time before transitioning completely to the new file. This helps prevent data designated for the old file from getting lost. By default, this time interval is 5 seconds.

The rotate_wait parameter accepts a single integer representing the number of seconds you want this time interval to be.

enable_watch_timer

Enable the additional watch timer. Setting this parameter to false will significantly reduce CPU and I/O consumption when tailing a large number of files on systems with inotify support. The default is true which results in an additional 1 second timer being used.

in_tail (via Cool.io) uses inotify on systems which support it. Earlier versions of libev on some platforms (eg Mac OS X) did not work properly; therefore, an explicit 1 second timer was used. Even on systems with inotify support, this results in additional I/O each second, for every file being tailed.

Early testing demonstrates that modern Cool.io and in_tail work properly without the additional watch timer. At some point in the future, depending on feedback and testing, the additional watch timer may be disabled by default.

ignore_repeated_permission_error

If you hard to exclude non-permision files from watching list, set this parameter to true. It suppress repeated permission error logs.

log_level option

The log_level option allows the user to set different levels of logging for each plugin. The supported log levels are: fatal, error, warn, info, debug, and trace.

FAQ

in_tail doesn't start to read log file, why?

in_tail follows tail -F command behaviour by default, so in_tail reads only newer logs. If you want to read existing lines for batch use case, set read_from_head true.

logrotate setting

logrotate has nocreate parameter and it doesn't create new file after triggered log rotation. It means in_tail can't find new file to tail.

This parameter doesn't fit typical application log cases, so check your logrotate setting which doesn't include nocreate parameter.

What happens when in_tail receives BufferQueueLimitError?

in_tail stops reading new lines and pos file update until BufferQueueLimitError is resolved. After resolved BufferQueueLimitError, restart emitting new lines and pos file update.

Please see the article for the basic structure and syntax of the configuration file.

in_tail removes untracked file position during startup phase. It means the content of pos_file is growing until restart when you tails lots of files with dynamic path setting. I will fix this problem in the future. Check .

The format of the log. in_tail uses parser plugin to parse the log. See for more detail.

Please see the for further details.

If this article is incorrect or outdated, or omits critical information, please . is a open source project under . All components are available under the Apache 2 License.

Config File
String#force_encoding
String#encode
this issue
parser article
logging article
let us know
Fluentd
Cloud Native Computing Foundation (CNCF)