devoinc / fluent-plugin-devo Goto Github PK

This is the setup I have:

• source is generating data in syslog - the data is already tagged (e.g. my.app.event.sample) at the source
• we have a fluentd installation that receives this syslog evente (in_syslog) plugin
• we need to send this data to Devo

The config and communication are all working, we can see the data in Devo (in the unknown.unknown table).

The problem is: the in_syslog plugin forces us to create a tag, in order to do proper routing. The out_devo plugin is using this tag to tag the data it is sending to Devo.

e.g. if I define my source and match as:

<source>
    @type syslog
    port 5140
    bind 0.0.0.0
    <transport tcp>
    </transport>
    tag mylogs
</source>

<match mylogs.**>
  @type devo
  host eu.elb.relay.logtrust.net
  port 443
  ca_cert <>
  client_cert <>
  client_key <>
  verify_cert_name false
  <format>
    @type single_value
    message_key message
  </format>
</store>

The data I receive at Devo is always tagges as mylogs.user.notice, and hence ends up in unknown.uknown

The incoming data is already tagged with the proper Devo tag (each event could have a different Devo tag)
How do I ensure that the tag in the incoming syslog is used in the output as well (and NOT the tag used for routing)?

In a high logging cluster, without file buffer there is loss of logs during fluentd restart.