You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: pipeline/inputs/exec.md
+53-44Lines changed: 53 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,42 +1,50 @@
1
1
# Exec
2
2
3
-
The **exec** input plugin, allows to execute external program and collects event logs.
3
+
The _Exec_ input plugin lets you execute external programs and collects event logs.
4
4
5
-
**WARNING**: Because this plugin invokes commands via a shell, its inputs are
6
-
subject to shell metacharacter substitution. Careless use of untrusted input in
7
-
command arguments could lead to malicious command execution.
5
+
{% hint style="warning" %}
6
+
7
+
This plugin invokes commands using a shell. Its inputs are subject to shell metacharacter substitution. Careless use of untrusted input in command arguments could lead to malicious command execution.
8
+
9
+
{% end hint %}
8
10
9
11
## Container support
10
12
11
-
This plugin will not function in all the distroless production images as it needs a functional `/bin/sh` which is not present.
12
-
The debug images use the same binaries so even though they have a shell, there is no support for this plugin as it is compiled out.
13
+
This plugin needs a functional `/bin/sh` and won't function in all the distroless production images.
14
+
15
+
The debug images use the same binaries so even though they have a shell, there is no support for this plugin as it's compiled out.
13
16
14
-
## Configuration Parameters
17
+
## Configuration parameters
15
18
16
19
The plugin supports the following configuration parameters:
17
20
18
21
| Key | Description |
19
22
| :--- | :--- |
20
-
| Command | The command to execute, passed to [popen(...)](https://man7.org/linux/man-pages/man3/popen.3.html) without any additional escaping or processing. May include pipelines, redirection, command-substitution, etc. |
21
-
| Parser | Specify the name of a parser to interpret the entry as a structured message. |
|Buf\_Size| Size of the buffer\(check[unit sizes](../../administration/configuring-fluent-bit/unit-sizes.md) for allowed values\)|
25
-
| Oneshot | Only run once at startup. This allows collection of data precedent to fluent-bit's startup (bool, default: false)|
26
-
|Exit\_After\_Oneshot| Exit as soon as the one-shot command exits. This allows the exec plugin to be used as a wrapper for another command, sending the target command's output to any fluent-bit sink(s) then exiting. (bool, default: false)|
27
-
|Propagate\_Exit\_Code| When exiting due to Exit\_After\_Oneshot, cause fluent-bit to exit with the exit code of the command exited by this plugin. Follows [shell conventions for exit code propagation](https://www.gnu.org/software/bash/manual/html_node/Exit-Status.html). (bool, default: false)|
28
-
| Threaded | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). Default: `false`. |
29
-
30
-
## Getting Started
23
+
|`Command`| The command to execute, passed to [popen](https://man7.org/linux/man-pages/man3/popen.3.html) without any additional escaping or processing. Can include pipelines, redirection, command-substitution, or other information. |
24
+
|`Parser`| Specify the name of a parser to interpret the entry as a structured message. |
|`Buf_Size`| Size of the buffer. See[unit sizes](../../administration/configuring-fluent-bit/unit-sizes.md) for allowed values.|
28
+
|`Oneshot`| Only run once at startup. This allows collection of data precedent to Fluent Bit startup (Boolean, default: `false`).|
29
+
|`Exit_After_Oneshot`| Exit as soon as the one-shot command exits. This allows the `exec` plugin to be used as a wrapper for another command, sending the target command's output to any Fluent Bit sink, then exits. (Boolean, default: `false`).|
30
+
|`Propagate_Exit_Code`| When exiting due to `Exit_After_Oneshot`, cause Fluent Bit to exit with the exit code of the command exited by this plugin. Follows [shell conventions for exit code propagation](https://www.gnu.org/software/bash/manual/html_node/Exit-Status.html). (Boolean, default: `false`).|
31
+
|`Threaded`| Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). Default: `false`. |
32
+
33
+
## Get started
31
34
32
35
You can run the plugin from the command line or through the configuration file:
33
36
34
-
### Command Line
37
+
### Command line
35
38
36
39
The following example will read events from the output of _ls_.
Translation of command exit code(s) to `fluent-bit` exit code follows
155
-
[the usual shell rules for exit code handling](https://www.gnu.org/software/bash/manual/html_node/Exit-Status.html).
156
-
Like with a shell, there is no way to differentiate between the command exiting
157
-
on a signal and the shell exiting on a signal, and no way to differentiate
158
-
between normal exits with codes greater than 125 and abnormal or signal exits
159
-
reported by fluent-bit or the shell. Wrapped commands should use exit codes
160
-
between 0 and 125 inclusive to allow reliable identification of normal exit.
161
-
If the command is a pipeline, the exit code will be the exit code of the last
162
-
command in the pipeline unless overridden by shell options.
169
+
Translation of command exit codes to Fluent Bit exit code follows [the usual shell rules for exit code handling](https://www.gnu.org/software/bash/manual/html_node/Exit-Status.html). Like with a shell, there is no way to differentiate between the command exiting on a signal and the shell exiting on a signal. Similarly, there is no way to differentiate between normal exits with codes greater than `125` and abnormal or signal exits reported by Fluent Bit or the shell. Wrapped commands should use exit codes between `0` and `125` inclusive to allow reliable identification of normal exit. If the command is a pipeline, the exit code will be the exit code of the last command in the pipeline unless overridden by shell options.
163
170
164
171
### Parsing command output
165
172
166
-
By default the `exec` plugin emits one message per command output line, with a
167
-
single field `exec` containing the full message. Use the `Parser` directive to
168
-
specify the name of a parser configuration to use to process the command input.
173
+
By default the `exec` plugin emits one message per command output line, with a single field `exec` containing the full message. Use the `Parser` directive to specify the name of a parser configuration to use to process the command input.
169
174
170
175
### Security concerns
171
176
172
-
**Take great care with shell quoting and escaping when wrapping commands**.
177
+
{% hint style="warning" %}
178
+
179
+
Take great care with shell quoting and escaping when wrapping commands**.
180
+
181
+
{% endhint %}
182
+
173
183
A script like
174
184
175
185
```bash
@@ -186,11 +196,10 @@ exec fluent-bit \
186
196
can ruin your day if someone passes it the argument
187
197
`$(rm -rf /my/important/files; echo "deleted your stuff!")'`
188
198
189
-
The above script would be safer if written with:
199
+
The previous script would be safer if written with:
190
200
191
201
```bash
192
202
-p command='echo '"$(printf '%q' "$@")" \
193
203
```
194
204
195
-
... but it's generally best to avoid dynamically generating the command or
196
-
handling untrusted arguments to it at all.
205
+
It's generally best to avoid dynamically generating the command or handling untrusted arguments.
0 commit comments