Output plugin for Fluent Bit which can send logs to Sumo Logic!
Build the code in this repository as a c-shared object, using the following command:
go build -buildmode=c-shared -o out_sumologic.so main.goRun Fluent Bit with this new plugin, using the following command:
fluent-bit -e out_sumologic.so -i tail -o sumologicRefer to the Fluent Bit Docs and this Dockerfile for more hints.
This plugin supports the following configuration properties:
| Property | Required | Default Value | Tag Substitution | Description |
|---|---|---|---|---|
Collector_Url |
✅ | ❌ | ❌ | Sumo Logic Hosted Collector Endpoint for Logs. For more details refer to - Sumo Logic Docs |
Match |
✅ | ❌ | ❌ | Used to route data between the input and output plugins in Fluent Bit. For more details refer to - Fluent Bit Docs |
Source_Name |
❌ | Unconfigured | ✅ | Specify an override for the Source Name. Defaults to the Collector Source Name configured in Sumo Logic |
Source_Host |
❌ | os.Hostname() |
✅ | Specify an override for the Source Host. Defaults to the hostname returned by the kernel |
Source_Category |
❌ | sumologic_default |
✅ | Specify the Source Category to send logs to in Sumo Logic |
Tag_Delimiter |
❌ | . |
❌ | Used to split the tag sent by the input plugin, helps with the Tag Substitution |
Level |
❌ | info |
❌ | Specify the log level for the plugin. Defaults to info |
Log_Key |
❌ | log |
❌ | Specify the field to be extracted from the json record, sends the entire record to Sumo Logic otherwise. |
Max_Retries |
❌ | 10 |
❌ | Max retries in case of failures when attempting to communicate with Sumo Logic |
The plugin supports dynamically populating the supported configuration options with values from the tag sent by the input plugin.
Example configuration
[INPUT]
Name tail
Path /var/log/containers/*.log
Parser docker
Tag kube.<namespace_name>.<pod_name>.<container_name>
Tag_Regex (?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-
[OUTPUT]
Name sumologic
Match kube.*
Collector_Url url
Tag_Delimiter .
Source_Host $TAG[1]_$TAG[2]
Level infoIn the above configuration, the tag is populated with the information about the Kubernetes Namespace, Pod Name, and Container Name by the input plugin.
This tag is then split by the sumologic plugin with the help from the Tag_Delimiter property to create the TagSlice and replaces all the occurrences of $TAG[i] (where i is the index of the element in TagSlice)
So in this case Source_Host would be evalutated as <namespace_name>_<pod_name>, which is very helpful in environments like Kubernetes.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent