systemd input plugin for Fluentd

Overview

systemd input plugin reads logs from the systemd journal

Installation

Simply use RubyGems:

gem install fluent-plugin-systemd -v 0.0.5

or

fluent-gem install fluent-plugin-systemd -v 0.0.5

or

td-agent-gem install fluent-plugin-systemd -v 0.0.5

Configuration

<source>
  type systemd
  path /var/log/journal
  filters [{ "_SYSTEMD_UNIT": "kube-proxy.service" }]
  pos_file kube-proxy.pos
  tag kube-proxy
  read_from_head true
</source>

path

Path to the systemd journal, defaults to /var/log/journal

filters

Array of filters, see here for further documentation, defaults to no filtering.

pos file

Path to pos file, stores the journald cursor. File is created if does not exist.

read_from_head

If true reads all available journal from head, otherwise starts reading from tail, ignored if pos file exists (and is valid). Defaults to false.

strip_underscores

If true strips underscores from the beginning of systemd field names. May be useful if outputting to kibana, as underscore prefixed fields are unindexed there.

tag

Required A tag that will be added to events generated by this input.

Example

For an example of a full working setup including the plugin, take a look at

Dependencies

This plugin depends on libsystemd

Running the tests

To run the tests with docker on several distros simply run rake

For systems with systemd installed you can run the tests against your installed libsystemd with rake test

Licence etc

MIT

Issues and pull requests welcome

Contributors

Many thanks to our brilliant contributors

frsyuki / fluent-plugin-systemd