Skip to content

Commit fbcbc52

Browse files
eschabelledsiper
authored andcommitted
Added YAML configuration examples to all classic config sections in the tail input plugin doc page.
Signed-off-by: Eric D. Schabell <[email protected]>
1 parent 83151b4 commit fbcbc52

File tree

1 file changed

+61
-4
lines changed

1 file changed

+61
-4
lines changed

pipeline/inputs/tail.md

+61-4
Original file line numberDiff line numberDiff line change
@@ -136,10 +136,10 @@ In your main configuration file, append the following `Input` and `Output` secti
136136

137137
{% tabs %}
138138
{% tab title="fluent-bit.conf" %}
139-
```python
139+
```text
140140
[INPUT]
141-
Name tail
142-
Path /var/log/syslog
141+
Name tail
142+
Path /var/log/syslog
143143
144144
[OUTPUT]
145145
Name stdout
@@ -180,6 +180,9 @@ We need to specify a `Parser_Firstline` parameter that matches the first line of
180180

181181
In the case above we can use the following parser, that extracts the Time as `time` and the remaining portion of the multiline as `log`
182182

183+
184+
{% tabs %}
185+
{% tab title="fluent-bit.conf" %}
183186
```text
184187
[PARSER]
185188
Name multiline
@@ -188,9 +191,24 @@ In the case above we can use the following parser, that extracts the Time as `ti
188191
Time_Key time
189192
Time_Format %b %d %H:%M:%S
190193
```
194+
{% endtab %}
195+
196+
{% tab title="fluent-bit.yaml" %}
197+
```yaml
198+
parsers:
199+
- name: multiline
200+
format: regex
201+
regex: '/(?<time>[A-Za-z]+ \d+ \d+\:\d+\:\d+)(?<message>.*)/'
202+
time_key: time
203+
time_format: '%b %d %H:%M:%S'
204+
```
205+
{% endtab %}
206+
{% endtabs %}
191207

192208
If we want to further parse the entire event we can add additional parsers with `Parser_N` where N is an integer. The final Fluent Bit configuration looks like the following:
193209

210+
{% tabs %}
211+
{% tab title="fluent-bit.conf" %}
194212
```text
195213
# Note this is generally added to parsers.conf and referenced in [SERVICE]
196214
[PARSER]
@@ -210,6 +228,31 @@ If we want to further parse the entire event we can add additional parsers with
210228
Name stdout
211229
Match *
212230
```
231+
{% endtab %}
232+
233+
{% tab title="fluent-bit.yaml" %}
234+
```yaml
235+
parsers:
236+
- name: multiline
237+
format: regex
238+
regex: '/(?<time>[A-Za-z]+ \d+ \d+\:\d+\:\d+)(?<message>.*)/'
239+
time_key: time
240+
time_format: '%b %d %H:%M:%S'
241+
242+
pipeline:
243+
inputs:
244+
- name: tail
245+
multiline: on
246+
read_from_head: true
247+
parser_firstline: multiline
248+
path: /var/log/java.log
249+
250+
outputs:
251+
- name: stdout
252+
match: '*'
253+
```
254+
{% endtab %}
255+
{% endtabs %}
213256

214257
Our output will be as follows.
215258

@@ -262,12 +305,26 @@ Fluent Bit keep the state or checkpoint of each file through using a SQLite data
262305

263306
The SQLite journaling mode enabled is `Write Ahead Log` or `WAL`. This allows to improve performance of read and write operations to disk. When enabled, you will see in your file system additional files being created, consider the following configuration statement:
264307

308+
{% tabs %}
309+
{% tab title="fluent-bit.conf" %}
265310
```text
266311
[INPUT]
267312
name tail
268313
path /var/log/containers/*.log
269314
db test.db
270315
```
316+
{% endtab %}
317+
318+
{% tab title="fluent-bit.yaml" %}
319+
```yaml
320+
pipeline:
321+
inputs:
322+
- name: tail
323+
path: /var/log/containers/*.log
324+
db: test.db
325+
```
326+
{% endtab %}
327+
{% endtabs %}
271328

272329
The above configuration enables a database file called `test.db` and in the same path for that file SQLite will create two additional files:
273330

@@ -284,4 +341,4 @@ The `WAL` mechanism give us higher performance but also might increase the memor
284341

285342
File rotation is properly handled, including logrotate's _copytruncate_ mode.
286343

287-
Note that the `Path` patterns **cannot** match the rotated files. Otherwise, the rotated file would be read again and lead to duplicate records.
344+
Note that the `Path` patterns **cannot** match the rotated files. Otherwise, the rotated file would be read again and lead to duplicate records.

0 commit comments

Comments
 (0)