Skip to content

Using Fluentbit to parse and forward logs to elastic

Notifications You must be signed in to change notification settings

xogoodnow/Log_Shipper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

50 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Production Ready Log shipper

A Fluentbit implementation for production use on different modes

Components Used

Name:Version Documentation Purpose Alternatives Advantages
Ansible 2.15.2 Docs Automating Tasks Salt 1. No footprint on target hosts
Ubuntu 22.04 Docs Operating system Debian Centos 1. Bigger community
2. Faster releases than debian
3. Bigger community than any other OS
4. Not cash grapping like centos (Yet :))
Fluentbit: 2.0.6 Docs Log Collctor/Shipper Logstash fluentd 1. No seperate component for shipper and collector
2. No extra dependency
3. Very efficient (faster than fluentd)
4. Almost zero foot print (Comparing to alternatives)
5. Much easier to setup and manage
6. Good number of useful plugins
Docker latest Docs Application Deployment and Management containerd podman 1. Much more bells and wistels are included out of the box comparing to alternatives
2. Awsome community and documentation
3. Easy to work with

Before you begin

Note Each ansible role has a general and a specific Readme file. It is encouraged to read them before firing off

p.s: Start with the readme file of main setup playbook First of all, fill out the all.yaml vars file based on your requirements image

Second fill out the inventory file (just put in the IP address and additional hosts if needed)

image

Work flow

  • Run the following command for fire off the ansible on the given targets
PWD='../'  ansible-playbook -i inventory.yaml Playbooks/Setup.yaml --private-key SSH_Keys/private_key.pem 

image

  • On the target node, check the logs for the container

Note Keep in mind that is tcp and udp mode, fluentbit patiently waits for your input as stream. This is for the tail mode (the container name might differ in your case, based on the index of node in the inventory)

docker logs -f Fluentbit-tail-log_shipper_1-0

image

  • Checking kibana to see if logs have been sent propely

Note Some random auth log is being sent here for demonstartion purpose image

About

Using Fluentbit to parse and forward logs to elastic

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages