0

我们有一个带有以下标签的 td_agent.conf 文件：

#this filter is used for C API which remove "[stdout]" from log
#if CLOG Unified Logging C API won't be used, this filter can be removed
<filter k.**.log>
@type parser
format /^(\[stdout\])*(?<log>.+)$/
key_name log
suppress_parse_error_log true
</filter>

以及以下示例日志行：

{"host":"omer","level":"TRACE","log":{"classname":"Manager:452","message":"^~\"DD\"-^ TRACE Added context","stacktrace":"","threadname":"Processing-ThreadPool-2"},"process":"Context","service":"","time":"2020-11-04T13:37:12.979Z","timezone":"Kolkata","type":"log"}

在 Fluentd 中具有上述逻辑时，我们会输出日志，并发出 log: {}，这意味着在弹性数据库中没有我们想要的信息。删除标签时，一切正常。谁能解释为什么需要这样做？

td-agent 的开始是：

<source>
@type tail
path /var/log/containers/*s*.log
pos_file /var/log/td-agent/containers.json.access.pos
tag k.*
#read_from_head true
<parse>
    @type regexp
    expression /(^(?<header>[^\{]+)?(?<message>\{.+\})$)|(^(?<log>[^\{].+))/
</parse>
</source>


<filter k.var.log.containers.**.log>
  @type parser
  key_name message
  format json
  #time_parse false
  time_key time
  time_format %iso8601
  keep_time_key true
</filter>


#this filter is used for C API which remove "[stdout]" from log
#if CLOG Unified Logging C API won't be used, this filter can be removed
<filter k.**.log>
@type parser
format /^(\[stdout\])*(?<log>.+)$/
key_name log
suppress_parse_error_log true
</filter>

4

0 回答 0