✨ Add: vector.dev log aggregator (removes fluentd) (#1209)

* wip

* Add csi-s3 and have portainer use it

* Change request @Hrytsuk 1GB max portainer volume size

* Arch Linux Certificates Customization

* Fix pgsql exporter failure

* [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉  (#979)

* Introduce longhorn chart

* Further longhorn configuration

* Longhorn: further settings configuration

* Fix longhorn configuration bugs

Extra: introduce longhorn pv vales for portainer

* Add comment for deletion longhorn

* Further longhorn configuration

* Add README.md for Longhorn wit FAQ

* Update Longhorn readme

* Update readme

* Futher LH configuration

* Update LH's Readme

* Update Longhorn Readme

* Improve LH's Readme

* LH: Reduce reserved default disk space to 5%

Since we use a dedicated disk for LH, we can go ahead with 5%

* Use values to set Longhorn storage class

* Update LH's Readme

* LH Readme: add requirements reference

* PR Review: bring back portainer s3 pv

* LH: decrease portinaer volume size

* Experimental: Try to add tracing to simcore-traefik on master

* Fixes ITISFoundation/osparc-simcore#7363

* Arch Linux Certificates Customization - 2

* Change fluentd for fluentbit

* fix

* Switch fluentbit for vectordev

* fix

* fix

---------

Co-authored-by: Dustin Kaiser <[email protected]>
Co-authored-by: YH <[email protected]>

Author: mrnicegyu11

services/logging/docker-compose.aws.yml

@@ -15,7 +15,7 @@ services:
         constraints:
           - node.labels.logging==true
 
-  fluentd:
+  vector:
     deploy:
       placement:
         constraints:

services/logging/docker-compose.dalco.yml

@@ -17,7 +17,7 @@ services:
         constraints:
           - node.labels.logging==true
 
-  fluentd:
+  vector:
     deploy:
       placement:
         constraints:

services/logging/docker-compose.local.yml

@@ -14,7 +14,7 @@ services:
       placement:
         constraints: []
 
-  fluentd:
+  vector:
     deploy:
       placement:
         constraints: []

services/logging/docker-compose.master.yml

@@ -17,7 +17,7 @@ services:
         constraints:
           - node.labels.logging==true
 
-  fluentd:
+  vector:
     deploy:
       placement:
         constraints:

services/logging/docker-compose.yml.j2

@@ -51,7 +51,6 @@ services:
   graylog:
     image: graylog/graylog:6.0.5
     init: true
-    # user: "1000:1001"
     configs:
     - source: graylog_config
       target: /files/osparc-custom-content-pack-v2.json
@@ -76,7 +75,7 @@ services:
         aliases:
           - graylog
     ports:
-    - 12201:12201/udp
+    - 12200:12201/udp
     - 12202:12202/udp
     deploy:
       replicas: 1
@@ -100,42 +99,29 @@ services:
         - traefik.http.middlewares.graylog_replace_regex.replacepathregex.regex=^/graylog/?(.*)$$
         - traefik.http.middlewares.graylog_replace_regex.replacepathregex.replacement=/$${1}
         - traefik.http.routers.graylog.middlewares=ops_whitelist_ips@swarm, ops_gzip@swarm, graylog_replace_regex
-  fluentd:
-    image: itisfoundation/fluentd:v1.16.9-1.0
-    configs:
-      - source: fluentd_config
-        target: /fluentd/etc/fluent.conf
-    environment:
-      - GRAYLOG_HOST=graylog
-      - GRAYLOG_PORT=12201
-      - LOKI_URL=http://loki:3100
-      - FLUENTD_HOSTNAME={% raw %}{{.Node.Hostname}}{% endraw %}
+  vector:
+    image: timberio/vector:0.49.X-debian
     ports:
-      - "24224:24224/tcp"
+      - "12201:12201/udp"  # GELF input
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - VECTOR_CONFIG=/etc/vector/vector.yaml
+      - VECTOR_LOG=info
+    configs:
+      - source: vector_config
+        target: /etc/vector/vector.yaml
     deploy:
-      #mode: global  # Run on all nodes
-      restart_policy:
-        condition: on-failure
       resources:
         limits:
-          cpus: '1.0'
-          memory: 1G
-        reservations:
-          cpus: '0.5'
+          cpus: "1.0"
           memory: 512M
-      update_config:
-        parallelism: 1
-        delay: 10s
-        order: start-first
+        reservations:
+          memory: 256M
+      labels: []
     networks:
       - monitoring
       - graylog
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://0.0.0.0:24220/api/plugins"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 40s
 
   loki:
     image: grafana/loki:3.5.4
@@ -196,9 +182,9 @@ configs:
   graylog_config:
     name: ${STACK_NAME}_graylog_config_{{ "./data/contentpacks/osparc-custom-content-pack-v2.json" | sha256file | substring(0,10) }}
     file: ./data/contentpacks/osparc-custom-content-pack-v2.json
-  fluentd_config:
-    name: ${STACK_NAME}_fluentd_config_{{ "./fluentd/fluent.conf" | sha256file | substring(0,10) }}
-    file: ./fluentd/fluent.conf
+  vector_config:
+    name: ${STACK_NAME}_vector_config_{{ "./vector.yaml" | sha256file | substring(0,10) }}
+    file: ./vector.yaml
   loki_config:
     name: ${STACK_NAME}_loki_config_{{ "./loki.yaml" | sha256file | substring(0,10) }}
     file: ./loki.yaml

services/logging/fluentd/Dockerfile

@@ -0,0 +1,98 @@
+# Vector configuration to replace Fluent Bit
+# Ingests GELF logs from Docker daemon and forwards to Loki and Graylog
+
+sources:
+  # Receive GELF messages from Docker containers via UDP
+  docker_gelf:
+    type: socket
+    address: "0.0.0.0:12201"
+    mode: udp
+    decoding:
+      codec: gelf
+    framing:
+      method: chunked_gelf
+      # Auto-detect compression (gzip, zlib, or uncompressed)
+      decompression: Auto
+
+transforms:
+  # Process and enrich the logs
+  process_logs:
+    type: remap
+    inputs: ["docker_gelf"]
+    source: |
+      if !exists(.host) {
+        .host = get_hostname!()
+      }
+
+      # Map short_message to message for Loki compatibility
+      if exists(.short_message) {
+        .message = .short_message
+      }
+
+      # Handle container name - GELF uses _container_name (with underscore prefix)
+      if exists(._container_name) {
+        .container_name = ._container_name
+      } else {
+        .container_name = "unknown"
+      }
+
+      # Handle container ID
+      if exists(._container_id) {
+        .container_id = ._container_id
+      } else {
+        .container_id = "unknown"
+      }
+
+      # Handle image name
+      if exists(._image_name) {
+        .image_name = ._image_name
+      } else {
+        .image_name = "unknown"
+      }
+
+      # Add processing metadata
+      .processed_by = "vector"
+
+sinks:
+  # Send to Loki
+  loki:
+    type: loki
+    inputs: ["process_logs"]
+    endpoint: "http://loki:3100"
+    encoding:
+      codec: json
+    labels:
+      job: "docker"
+      source: "vector"
+      # Simple field references - defaults are set in transform above
+      host: "{{ host }}"
+      container_name: "{{ container_name }}"
+    # Remove label fields from the log line to avoid duplication
+    remove_label_fields: true
+    healthcheck:
+      enabled: true
+
+  # Send to Graylog via GELF over UDP (not TCP with framing)
+  graylog:
+    type: socket
+    inputs: ["process_logs"]
+    address: "logging_graylog:12201"
+    mode: udp
+    encoding:
+      codec: gelf
+    healthcheck:
+      enabled: true
+
+  # Temporary: Output to console for debugging
+  #console_debug:
+  #  type: console
+  #  inputs: ["process_logs"]
+  #  encoding:
+  #    codec: json
+
+# Global configuration
+api:
+  enabled: true
+  address: "0.0.0.0:8686"
+
+data_dir: "/var/lib/vector"