# Receive events from 24224/tcp # This is used by log forwarding and the fluent-cat command <source> @type forward port 24224 </source> # http://this.host:9880/myapp.access?json={"event":"data"} <source> @type http port 9880 </source> <source> @type tail @label @SYSTEM </source> <label @SYSTEM> <filter var.log.middleware.**> @type grep # ... </filter> <match **> @type s3 # ... </match> </label> <filter myapp.access> @type record_transformer <record> host_param "#{Socket.gethostname}" </record> </filter> # Match events tagged with "myapp.access" and # store them to /var/log/fluent/access.%Y-%m-%d # Of course, you can control how you partition your data # with the time_slice_format option. <match myapp.access> @type file path /var/log/fluent/access </match> # Include config files in the ./config.d directory @include config.d/*.conf array_param [ "a", "b" ] hash_param { "k":"v", "k1":10 } <match **> @type mail subject "[CRITICAL] foo's alert system" </match> <match tag> @type map map '[["code." + tag, time, { "code" => record["code"].to_i}], ["time." + tag, time, { "time" => record["time"].to_i}]]' multi true </match> str_param "foo" host_param "#{Socket.gethostname}" # host_param is actual hostname like `webserver1`. str_param "foo\nbar" # \n is interpreted as actual LF character