Bonjour,
J'aurais besoin d'aide svp.
J'ai une application Spring Boot avec le logger logback. Les logs sont écrites sous format JSON.
Je remonte les logs vers Graylog avec Fluent-bit.
Mais le contenu de mes logs n'est pas parsé, et se retrouve dans le champ message sous Graylog.
Voici ma config logback.xml
Voici ma config Fluent-bit :
> apiVersion: v1
> kind: ConfigMap
> metadata:
> name: fluent-bit-config
> namespace: logging
> labels:
> k8s-app: fluent-bit
> data:
> # Configuration files: server, input, filters and output
> # ======================================================
> fluent-bit.conf: |
> SERVICE]
> Flush 1
> Log_Level info
> Daemon off
> Parsers_File parsers.conf
> HTTP_Server On
> HTTP_Listen 0.0.0.0
> HTTP_Port 2020
> @INCLUDE input-kubernetes.conf
> @INCLUDE filter-kubernetes.conf
> @INCLUDE output-ldp.conf
> input-kubernetes.conf: |
> [INPUT]
> Name tail
> Tag kube.
> Path /var/log/containers/bako-admin.log
> Parser json
> DB /var/log/flb_kube.db
> Mem_Buf_Limit 5MB
> Skip_Long_Lines On
> Refresh_Interval 10
> filter-kubernetes.conf: |
> [FILTER]
> Name kubernetes
> Match kube.
> Kube_URL https://kubernetes.default.svc:443
> Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
> Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
> Kube_Tag_Prefix kube.var.log.containers.
> Merge_Log Off
> Merge_Log_Key log_processed
> K8S-Logging.Parser On
> K8S-Logging.Exclude Off
> [FILTER]
> Name record_modifier
> Match
> Record X-OVH-TOKEN ${FLUENT_LDP_TOKEN}
> [FILTER]
> Name record_modifier
> Match
> Record fluent-bit-host ${HOSTNAME}
> [FILTER]
> Name nest
> Match
> Wildcard pod_name
> Operation lift
> Nested_under kubernetes
> Add_prefix kubernetes_
> [FILTER]
> Name modify
> Match
> Copy kubernetes_pod_name host
> [FILTER]
> Name modify
> Match
> Rename log short_message
> output-ldp.conf: |
> [OUTPUT]
> Name gelf
> Match
> Host ${FLUENT_LDP_HOST}
> Port ${FLUENT_LDP_PORT}
> Mode tls
> tls On
> Compress False
> parsers.conf: |
> [PARSER]
> Name apache
> Format regex
> Regex ^(?[^ ]) [^ ] (?[^ ]) [(?[^]])] "(?\S+)(?: +(?[^"]?)(?: +\S)?)?" (?
[^ ]) (?[^ ])(?: "(?[^"])" "(?[^"])")?$
> Time_Key time
> Time_Format %d/%b/%Y:%H:%M:%S %z
> [PARSER]
> Name apache2
> Format regex
> Regex ^(?[^ ]) [^ ] (?[^ ]) [(?[^]])] "(?\S+)(?: +(?[^ ]) +\S)?" (?[^ ]) (?[^ ])(?: "(?[^"])" "(?[^"])")?$
> Time_Key time
> Time_Format %d/%b/%Y:%H:%M:%S %z
> [PARSER]
> Name apache_error
> Format regex
> Regex ^[[^ ]* (?[^]])] [(?[^]])</code>])?( [client (?[^]])])? (?.)$
> [PARSER]
> Name nginx
> Format regex
> Regex ^(?[^ ]) (?[^ ]) (?[^ ]) [(?[^]])] "(?\S+)(?: +(?[^"]?)(?: +\S)?)?" (?[^ ]) (?[^ ])(?: "(?[^"])" "(?[^"])")?$
> Time_Key time
> Time_Format %d/%b/%Y:%H:%M:%S %z
> [PARSER]
> Name json
> Format json
> Time_Key time
> Time_Format %d/%b/%Y:%H:%M:%S %z
> Decode_Field_As json message
> [PARSER]
> Name docker
> Format json
> Time_Key time
> Time_Format %Y-%m-%dT%H:%M:%S.%L
> Time_Keep On
> [PARSER]
> Name syslog
> Format regex
> Regex ^<(?[0-9]+)>(?[^ ]* {1,2}[^ ]* [^ ]) (?[^ ]) (?[a-zA-Z0-9_/.-])(?:[(?[0-9]+)])?(?:[^:]:)? (?.)$
> Time_Key time
> Time_Format %b %d %H:%M:%S
Qu'est ce que j'ai oublié ?
Merci pour votre aide
Johann
!