fluent でログの集約

インストール

全サーバにtd-agentインストールする。

# curl -L https://toolbelt.treasuredata.com/sh/install-redhat-td-agent3.sh | sh
# td-agent-gem install fluent-plugin-forest

必要なディレクトリ作成

# mkdir /etc/td-agent/config.d

# mkdir /var/log/td-agent/pos
# chown td-agent:td-agent /var/log/td-agent/pos

# chgrp td-agent /var/log/messages
# chmod g+r /var/log/messages

# mkdir -p /var/log/td-agent/aggregate
# chown td-agent:td-agent /var/log/td-agent/aggregate

# mkdir -p /var/log/td-agent/forward-failed
# chown td-agent:td-agent /var/log/td-agent/forward-failed

集約用サーバの設定

@include config.d/*.conf

<system>
  log_level info
  <log>
    time_format %Y-%m-%dT%H:%M:%S.%L
  </log>
</system>

<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>

<match fluent.**>
  @type null
</match>

<match **>
  @type forest
  subtype file
  <template>
    symlink_path /var/log/td-agent/aggregate/${tag_parts[0]}/${tag_parts[1]}/${tag_parts[2]}
    path /var/log/td-agent/aggregate/${tag[0]}/${tag[1]}/${tag[2]}.%Y%m/${tag}
    time_slice_format %Y%m%d-%H
    <buffer tag,time>
      @type file
      path /var/log/td-agent/buffer/${tag}.*.buffer
      timekey 3600
      timekey_wait 10m
      flush_at_shutdown true
      flush_interval 1h
      flush_mode interval
    </buffer>
    <format>
      @type json
    </format>
  </template>
</match>

ログ送信側の設定

@include config.d/*.conf

<system>
  log_level info
  <log>
    time_format %Y-%m-%dT%H:%M:%S.%L
  </log>
</system>

<source>
  @type tail
  format syslog
  path /var/log/messages
  tag hogesystem.common.messages
  pos_file /var/log/td-agent/pos/syslog.messages.pos
</source>

<match fluent.**>
  @type null
</match>

<match **>
  @type forward
  send_timeout 60s
  recover_wait 10s
  hard_timeout 60s
  #transport tls
  <buffer tag>
    flush_interval 1
  </buffer>
  <server>
    name logserver1
    host 192.168.22.11
    port 24224
    weight 60
  </server>
  <server>
    name logserver2
    host 192.168.22.12
    port 24224
    weight 60
    #standby
  </server>
  <secondary>
    @type file
    path /var/log/td-agent/forward-failed
  </secondary>
</match>