diff --git a/pipeline/inputs/tail.md b/pipeline/inputs/tail.md index 5e1f14cf2..f0d58dc49 100644 --- a/pipeline/inputs/tail.md +++ b/pipeline/inputs/tail.md @@ -56,26 +56,40 @@ Replace _`LIMIT1`_ and _`LIMIT2`_ with the integer values of your choosing. High However, these changes revert upon reboot unless you write them to the appropriate `inotify.conf` file, in which case they will persist across reboots. The specific name of this file might vary depending on how you built and installed Fluent Bit. For example, to write changes to a file named `fluent-bit_fs_inotify.conf`, run the following commands: ```shell -mkdir -p /etc/sysctl.d -echo fs.inotify.max_user_watches = LIMIT1 >> /etc/sysctl.d/fluent-bit_fs_inotify.conf -echo fs.inotify.max_user_instances = LIMIT2 >> /etc/sysctl.d/fluent-bit_fs_inotify.conf +$ mkdir -p /etc/sysctl.d +$ echo fs.inotify.max_user_watches = LIMIT1 >> /etc/sysctl.d/fluent-bit_fs_inotify.conf +$ echo fs.inotify.max_user_instances = LIMIT2 >> /etc/sysctl.d/fluent-bit_fs_inotify.conf ``` Replace _`LIMIT1`_ and _`LIMIT2`_ with the integer values of your choosing. -You can also provide a custom systemd configuration file that overrides the default systemd settings for Fluent Bit. This override file must be located at `/etc/systemd/system/fluent-bit.service.d/override.conf`. For example, you can add this snippet to your override file to raise the number of files that the Tail plugin can monitor: +You can also provide a custom systemd configuration file that overrides the default systemd settings for Fluent Bit. This override file must be located at `/etc/systemd/system/fluent-bit.service.d/override.conf` or `/etc/systemd/system/fluent-bit.service.d/override.yaml` depending +on the configuration you choose. For example, you can add one of these snippets to your override file to raise the number of files that the Tail plugin can monitor: +{% tabs %} +{% tab title="override.yaml" %} + +```yaml +service: + limitnofile: LIMIT +``` + +{% endtab %} +{% tab title="override.conf" %} ```text [Service] LimitNOFILE=LIMIT ``` +{% endtab %} +{% endtabs %} + Replace _`LIMIT`_ with the integer value of your choosing. If you don't already have an override file, you can use the following command to create one in the correct directory: -```shell copy -systemctl edit fluent-bit.service +```shell +$ systemctl edit fluent-bit.service ``` ## Multiline Support @@ -107,23 +121,26 @@ As stated in the [Multiline Parser documentation](../../administration/configuri If you are running Fluent Bit to process logs coming from containers like Docker or CRI, you can use the new built-in modes for such purposes. This will help to reassembly multiline messages originally split by Docker or CRI: {% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: tail + path: /var/log/containers/*.log + multiline.parser: docker, cri +``` + +{% endtab %} {% tab title="fluent-bit.conf" %} + ```text [INPUT] name tail path /var/log/containers/*.log multiline.parser docker, cri ``` -{% endtab %} -{% tab title="fluent-bit.yaml" %} -```yaml -pipeline: - inputs: - - name: tail - path: /var/log/containers/*.log - multiline.parser: docker, cri -``` {% endtab %} {% endtabs %} @@ -164,16 +181,31 @@ In order to tail text or log files, you can run the plugin from the command line From the command line you can let Fluent Bit parse text files with the following options: -```bash +```shell $ fluent-bit -i tail -p path=/var/log/syslog -o stdout ``` ### Configuration File -In your main configuration file, append the following `Input` and `Output` sections: +Append the following in your main configuration file: {% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: tail + path: /var/log/syslog + + outputs: + - stdout: + match: * +``` + +{% endtab %} {% tab title="fluent-bit.conf" %} + ```text [INPUT] Name tail @@ -183,24 +215,10 @@ In your main configuration file, append the following `Input` and `Output` secti Name stdout Match * ``` -{% endtab %} - -{% tab title="fluent-bit.yaml" %} -```yaml -pipeline: - inputs: - - name: tail - path: /var/log/syslog - outputs: - - stdout: - match: * -``` {% endtab %} {% endtabs %} -![](../../.gitbook/assets/image%20%286%29.png) - ### Old Multi-line example When using multi-line configuration you need to first specify `Multiline On` in the configuration and use the `Parser_Firstline` and additional parser parameters `Parser_N` if needed. If we are trying to read the following Java Stacktrace as a single event @@ -220,7 +238,20 @@ In the case above we can use the following parser, that extracts the Time as `ti {% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +parsers: + - name: multiline + format: regex + regex: '/(?