You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following Fluent Bit configuration file configures a pipeline to consume the log, while applying an Expect filter to validate that the keys `color` and `label` exist:
75
+
The following files configure a pipeline to consume the log, while applying an Expect filter to validate that the
76
+
keys `color` and `label` exist.
77
+
78
+
{% tabs %}
79
+
{% tab title="fluent-bit.yaml" %}
80
+
81
+
The following is the Fluent Bit YAML configuration file:
82
+
83
+
```yaml
84
+
service:
85
+
flush: 1
86
+
log_level: info
87
+
parsers_file: parsers.yaml
88
+
89
+
pipeline:
90
+
inputs:
91
+
- name: tail
92
+
path: data.log
93
+
parser: json
94
+
exit_on_eof: on
95
+
96
+
# First 'expect' filter to validate that our data was structured properly
97
+
filters:
98
+
- name: expect
99
+
match: '*'
100
+
key_exists:
101
+
- color
102
+
- $label['name']
103
+
action: exit
104
+
105
+
outputs:
106
+
- name: stdout
107
+
match: '*'
108
+
```
109
+
110
+
{% endtab %}
111
+
112
+
{% tab title="parsers.yaml" %}
113
+
114
+
The following is the Fluent Bit YAML parsers file:
115
+
116
+
```yaml
117
+
parsers:
118
+
- name: json
119
+
format: json
120
+
```
121
+
122
+
{% endtab %}
123
+
124
+
{% tab title="fluent-bit.conf" %}
76
125
77
-
```python
126
+
The following is the Fluent Bit classic configuration file:
127
+
128
+
```text
78
129
[SERVICE]
79
130
flush 1
80
131
log_level info
@@ -99,11 +150,84 @@ The following Fluent Bit configuration file configures a pipeline to consume the
99
150
match *
100
151
```
101
152
153
+
{% endtab %}
154
+
155
+
{% tab title="parsers.conf" %}
156
+
157
+
The following is the Fluent Bit classic parsers file:
158
+
159
+
```text
160
+
[PARSER]
161
+
Name json
162
+
Format json
163
+
```
164
+
165
+
{% endtab %}
166
+
{% endtabs %}
167
+
102
168
If the JSON parser fails or is missing in the [Tail](../pipeline/inputs/tail) input (`parser json`), the Expect filter triggers the `exit` action.
103
169
104
170
To extend the pipeline, add a Grep filter to match records that map `label` containing a key called `name` with value the `abc`, and add an Expect filter to re-validate that condition:
105
171
106
-
```python
172
+
{% tabs %}
173
+
{% tab title="fluent-bit.yaml" %}
174
+
175
+
The following is the Fluent Bit YAML configuration file:
176
+
177
+
```yaml
178
+
service:
179
+
flush: 1
180
+
log_level: info
181
+
parsers_file: parsers.yaml
182
+
183
+
pipeline:
184
+
inputs:
185
+
- name: tail
186
+
path: data.log
187
+
parser: json
188
+
exit_on_eof: on
189
+
190
+
# First 'expect' filter to validate that our data was structured properly
191
+
filters:
192
+
- name: expect
193
+
match: '*'
194
+
key_exists:
195
+
- color
196
+
- $label['name']
197
+
action: exit
198
+
199
+
# Match records that only contains map 'label' with key 'name' = 'abc'
200
+
- name: grep
201
+
match: '*'
202
+
regex: "$label['name'] ^abc$"
203
+
204
+
# Check that every record contains 'label' with a non-null value
205
+
- name: expect
206
+
match: '*'
207
+
key_val_eq: $label['name'] abc
208
+
action: exit
209
+
210
+
# Append a new key to the record using an environment variable
211
+
- name: record_modifier
212
+
match: '*'
213
+
record: hostname ${HOSTNAME}
214
+
215
+
# Check that every record contains 'hostname' key
216
+
- name: expect
217
+
match: '*'
218
+
key_exists: hostname
219
+
action: exit
220
+
221
+
outputs:
222
+
- name: stdout
223
+
match: '*'
224
+
```
225
+
226
+
{% endtab %}
227
+
228
+
{% tab title="fluent-bit.conf" %}
229
+
230
+
```text
107
231
[SERVICE]
108
232
flush 1
109
233
log_level info
@@ -154,6 +278,9 @@ To extend the pipeline, add a Grep filter to match records that map `label` cont
154
278
match *
155
279
```
156
280
281
+
{% endtab %}
282
+
{% endtabs %}
283
+
157
284
## Production deployment
158
285
159
-
When deploying in production, consider removing any Expect filters from your configuration file. These filters are unnecessary unless you need 100% coverage of checks at runtime.
286
+
When deploying in production, consider removing any `Expect` filters from your configuration file. These filters are unnecessary unless you need 100% coverage of checks at runtime.
0 commit comments