{"componentChunkName":"component---src-templates-post-template-jsx","path":"/history/posts/2022-09-17--001","result":{"data":{"site":{"siteMetadata":{"title":"Blog by Eunyoung","subtitle":"작업 기록 블로그","copyright":"© All rights reserved.","author":{"name":"EunYoung","twitter":"#"},"disqusShortname":"","url":"https://ssongey.github.io"}},"markdownRemark":{"id":"743678f9-5bc9-55a2-b96b-f19f8665ac01","html":"

✔️ 먼저 알아두면 좋은 내용

\n

1. common plugin parameters

\n\n

1.1. @type

\n\n

1.2. @id

\n\n

1.3. @label

\n\n

1.4. @log_level

\n\n

자세한 내용은 아래 참고

\n

Config: Common Parameters

\n
\n

2. wildcards, expansions and other tips

\n\n

2.1. *

\n\n

2.2. ``**

\n\n

2.3. 그외

\n\n
\n

3. Embedding Ruby Expressions

\n\n
<match \"app.#{ENV['FLUENTD_TAG']}\">\n  @type stdout\n</match>
\n
\n

✔️ Directive

\n

1. source

\n\n
# Receive events from 24224/tcp\n# This is used by log forwarding and the fluent-cat command\n<source>\n  @type forward\n  port 24224\n</source>\n\n# http://<ip>:9880/myapp.access?json={\"event\":\"data\"}\n<source>\n  @type http\n  port 9880\n</source>
\n

2. match

\n\n
# Receive events from 24224/tcp\n# This is used by log forwarding and the fluent-cat command\n<source>\n  @type forward\n  port 24224\n</source>\n\n# http://<ip>:9880/myapp.access?json={\"event\":\"data\"}\n<source>\n  @type http\n  port 9880\n</source>\n\n# Match events tagged with \"myapp.access\" and\n# store them to /var/log/fluent/access.%Y-%m-%d\n# Of course, you can control how you partition your data\n# with the time_slice_format option.\n<match myapp.access>\n  @type file\n  path /var/log/fluent/access\n</match>
\n

3. filter

\n\n

\n \n \n \n \n \n \n \n \n \n

\n
# http://this.host:9880/myapp.access?json={\"event\":\"data\"}\n<source>\n  @type http\n  port 9880\n</source>\n\n<filter myapp.access>\n  @type record_transformer\n  <record>\n    host_param \"#{Socket.gethostname}\"\n  </record>\n</filter>\n\n<match myapp.access>\n  @type file\n  path /var/log/fluent/access\n</match>
\n

✔️ 위 예제 동작 플로우

\n\n

\n \n \n \n \n \n \n \n \n \n

\n
\n

✔️ 서비스에 설정한 fluentd daemonset config 설정 분석

\n\n

1. Input에 대한 설정

\n
input-kubernetes.conf: |\n    <match fluent.**>\n      @type                           null\n    </match>\n    <source>\n      @type                           tail\n      @id                             in_tail_container_logs\n      path                            /var/log/containers/xoauth*.log\n      pos_file                        /var/log/fluentd-containers.log.pos\n      tag                             kubernetes.*\n      read_from_head                  \"#{ENV['FLUENTD_INPUT_READ_FROM_HEAD'] || 'false'}\"\n      limit_recently_modified         \"#{ENV['LIMIT_RECENTLY_MODIFIED'] || '120m'}\"\n      rotate_wait                     0\n      enable_stat_watcher             false\n      <parse>\n        @type                         regexp\n        expression                    /^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<flags>[^ ]+) (?<message>.*)$/\n      </parse>\n    </source>
\n

1.1. 로그 input

\n\n
<source>\n  @type                           tail\n  @id                             in_tail_container_logs\n  path                            /var/log/containers/xoauth*.log\n  pos_file                        /var/log/fluentd-containers.log.pos\n  tag                             kubernetes.*\n  read_from_head                  \"#{ENV['FLUENTD_INPUT_READ_FROM_HEAD'] || 'false'}\"\n  limit_recently_modified         \"#{ENV['LIMIT_RECENTLY_MODIFIED'] || '120m'}\"\n  rotate_wait                     0\n  enable_stat_watcher             false\n  <parse>\n    @type                         regexp\n    expression                    /^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<flags>[^ ]+) (?<message>.*)$/\n  </parse>\n</source>
\n\n
2022-08-23T16:20:02.313036458+09:00 stdout F {\"@timestamp\":\"2022-08-23T07:20:02.312+00:00\",\"@version\":\"1\",\"message\":\"Running with Spring Boot v2.2.0.RELEASE, Spring v5.2.0.RELEASE\",\"logger_name\":\"com.kakao.xoauth.XoauthApplication\",\"thread_name\":\"main\",\"level\":\"DEBUG\",\"level_value\":10000}
\n\n

\n \n \n \n \n \n \n \n \n \n

\n

1.2. fluentd 로그 제거

\n\n
<match fluent.**>\n  @type                           null\n</match>
\n
\n

2. Filter에 대한 설정

\n

✔️ 전체 코드

\n
filter-kubernetes.conf: |\n    <filter kubernetes.**>\n      @type                           kubernetes_metadata\n      @id                             filter_kube_metadata\n    </filter>\n    <filter kubernetes.**>\n      @type                           record_modifier\n      tag                             ${record.dig(\"kubernetes\", \"container_name\").gsub('-', '.')}\n      <record>\n        @timestamp                    ${(Time.at(time) + (60*60*9)).strftime('%Y-%m-%dT%H:%M:%S.%L+09:00')}\n        cluster_name                  \"xoauth-dev\"\n        hostname                      \"#{ENV['K8S_NODE_NAME']}\"\n        container_image               ${record.dig(\"kubernetes\", \"container_image\")}\n        pod_name                      ${record.dig(\"kubernetes\", \"pod_name\")}\n      </record>\n    </filter>\n    <filter kubernetes.**>\n      @type                           parser\n      key_name                        message\n      reserve_data                    true\n      remove_key_name_field           true\n      <parse>\n        @type                         json\n      </parse>\n    </filter>\n    <filter kubernetes.**>\n      @type                           record_transformer\n      remove_keys                     $.kubernetes\n    </filter>
\n

2.1. K8S Metadata 정보 포함시키기

\n\n
<filter kubernetes.**>\n  @type                           kubernetes_metadata\n  @id                             filter_kube_metadata\n</filter>
\n

✔️ fluent-plugin-kubernetesmetadatafilter 설치는 언제?

\n\n

\n \n \n \n \n \n \n \n \n \n

\n

✔️ input/output 에 대한 예제

\n

\n \n \n \n \n \n \n \n \n \n

\n

2.2. 이벤트 레코드에 필드 추가하기

\n\n
<filter kubernetes.**>\n  @type                           record_modifier\n  tag                             ${record.dig(\"kubernetes\", \"container_name\").gsub('-', '.')}\n  <record>\n    @timestamp                    ${(Time.at(time) + (60*60*9)).strftime('%Y-%m-%dT%H:%M:%S.%L+09:00')}\n    cluster_name                  \"xoauth-dev\"\n    hostname                      \"#{ENV['K8S_NODE_NAME']}\"\n    container_image               ${record.dig(\"kubernetes\", \"container_image\")}\n    pod_name                      ${record.dig(\"kubernetes\", \"pod_name\")}\n  </record>\n</filter>
\n

✔️ fluent-plugin-record-modifier 설치는 언제?

\n\n

\n \n \n \n \n \n \n \n \n \n

\n

✔️ record_transformer 와의 차이점은?

\n\n

2.3. 서비스 Application에서 출력한 로그 파싱

\n\n
<filter kubernetes.**>\n  @type                           parser\n  key_name                        message\n  reserve_data                    true\n  remove_key_name_field           true\n  <parse>\n    @type                         json\n  </parse>\n</filter>
\n

✔️ reserve_data

\n\n
<filter foo.bar>\n  @type parser\n  key_name log\n  reserve_data true\n  <parse>\n    @type json\n  </parse>\n</filter>
\n

\n \n \n \n \n \n \n \n \n \n

\n
\n

3. Output에 대한 설정

\n
<match **>\n  @type copy\n  <store>\n    @type                         kafka2\n    @id                           out_kafka\n    brokers                       logis-kafka.dev.kakaoi.io:9092\n    max_send_retries              10\n    required_acks                 1\n\n    default_topic                 xoauth-dev\n\n    exception_backup              false\n    compression_codec             gzip\n\n    <format>\n      @type                       json\n    </format>\n\n    <buffer topic,tag>\n      @type                       file\n      path                        /var/log/td-agent/buffer/td\n      flush_interval              5s\n      chunk_limit_size            16M\n      queue_limit_length          32\n      retry_forever               true\n    </buffer>\n  </store>\n</match>
","fields":{"tagSlugs":["/tags/fluentd/"],"slug":"/history/posts/2022-09-17--001"},"frontmatter":{"title":"Fluentd 설정파일 분석","tags":["fluentd"],"date":"2022-09-17","description":""}}},"pageContext":{"slug":"/history/posts/2022-09-17--001"}},"staticQueryHashes":[]}