Skip to content

pipeline: outputs: logdna: general cleanup #1972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 22, 2025
Merged

pipeline: outputs: logdna: general cleanup #1972

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8300ff0
pipeline: outputs: logdna: general cleanup
alexakreizinger Jul 22, 2025
5d4d8f0
pipeline: outputs: logdna: add alt text
alexakreizinger Jul 22, 2025
16ae1a5
Apply suggestions from code review
alexakreizinger Jul 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
143 changes: 36 additions & 107 deletions pipeline/outputs/logdna.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,112 +1,41 @@
# LogDNA

[LogDNA](https://logdna.com/) is an intuitive cloud based log management system that provides you an easy interface to query your logs once they are stored.

The Fluent Bit `logdna` output plugin allows you to send your log or events to a [LogDNA](https://logdna.com/) compliant service like:

* [LogDNA](https://logdna.com/)
* [IBM Log Analysis](https://www.ibm.com/cloud/log-analysis)

Before to get started with the plugin configuration, make sure to obtain the proper account to get access to the service. You can start with a free trial in the following link:

* [LogDNA Sign Up ](https://logdna.com/sign-up/)

## Configuration Parameters

<table>
<thead>
<tr>
<th style="text-align:left">Key</th>
<th style="text-align:left">Description</th>
<th style="text-align:left">Default</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align:left">logdna_host</td>
<td style="text-align:left">LogDNA API host address</td>
<td style="text-align:left">logs.logdna.com</td>
</tr>
<tr>
<td style="text-align:left">logdna_port</td>
<td style="text-align:left">LogDNA TCP Port</td>
<td style="text-align:left">443</td>
</tr>
<tr>
<td style="text-align:left">logdna_endpoint</td>
<td style="text-align:left">LogDNA ingestion endpoint</td>
<td style="text-align:left">/logs/ingest</td>
</tr>
<tr>
<td style="text-align:left">api_key</td>
<td style="text-align:left">API key to get access to the service. This property is <b>mandatory</b>.</td>
<td
style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">hostname</td>
<td style="text-align:left">
<p>Name of the local machine or device where Fluent Bit is running.
<br />
</p>
<p>When this value is not set, Fluent Bit lookup the hostname and auto populate
the value. If it cannot be found, an <code>unknown</code> value will be set
instead.</p>
</td>
<td style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">mac</td>
<td style="text-align:left">Mac address. This value is optional.</td>
<td style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">ip</td>
<td style="text-align:left">IP address of the local hostname. This value is optional.</td>
<td style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">tags</td>
<td style="text-align:left">A list of comma separated strings to group records in LogDNA and simplify
the query with filters.</td>
<td style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">file</td>
<td style="text-align:left">Optional name of a file being monitored. Note that this value is only
set if the record do not contain a reference to it.</td>
<td style="text-align:left"></td>
</tr>
<tr>
<td style="text-align:left">app</td>
<td style="text-align:left">Name of the application. This value is auto discovered on each record,
if not found, the default value is used.</td>
<td style="text-align:left">Fluent Bit</td>
</tr>
<tr>
<td style="text-align:left">workers</td>
<td style="text-align:left">The number of <a href="https://docs.fluentbit.io/manual/administration/multithreading#outputs">workers</a> to perform flush operations for this output.</td>
<td style="text-align:left">`0`</td>
</tr>
</tbody>
</table>

## Auto Enrichment & Data Discovery

One of the features of Fluent Bit + LogDNA integration is the ability to auto enrich each record with further context.

When the plugin process each record \(or log\), it tries to lookup for specific key names that might contain specific context for the record in question, the following table describe the keys and the discovery logic:
The _LogDNA_ output plugin sends logs and events to a LogDNA-compliant service.

## Configuration parameters

This plugin uses the following configuration parameters:

| Key | Description | Default |
| --- | ----------- | ------- |
| `logdna_host` | The LogDNA API host address. | `logs.logdna.com` |
| `logdna_port` | The LogDNA TCP Port. | `443` |
| `logdna_endpoint` | The LogDNA ingestion endpoint. | `/logs/ingest` |
| `api_key` | Required. The API key to get access to the service. | _none_ |
| `hostname` | Name of the local machine or device where Fluent Bit is running. If no value is specifies, Fluent Bit will look up the hostname and auto populate its value. If Fluent Bit is unable to find a value, it will set the value `unknown` instead. | _none_ |
| `mac` | The MAC address. This value is optional. | |
| `ip` | The IP address of the local hostname. This value is optional. | |
| `tags` | A list of comma-separated strings to group records in LogDNA and simplify the query with filters. | _none_ |
| `file` | Optional name of a file being monitored. This value is only set if the record doesn't contain a reference to it. | _none_ |
| `app` | Name of the application. This value is automatically discovered on each record. If no value is found, the default value is used. | `Fluent Bit` |
| `workers` | The number of [workers](../administration/multithreading#outputs) to perform flush operations for this output. | `0` |

## Data discovery and enrichment

The LogDNA output plugin can automatically discover and enrich records with additional content.

When the login processes a record or log, it searches for specific key names that might contain context for the record in question. The following table describe these keys and the discovery logic:

| Key | Description |
| :--- | :--- |
| level | If the record contains a key called `level` or `severity`, it will populate the context `level` key with that value. If not found, the context key is not set. |
| file | if the record contains a key called `file`, it will populate the context `file` with the value found, otherwise If the plugin configuration provided a `file` property, that value will be used instead \(see table above\). |
| app | If the record contains a key called `app`, it will populate the context `app` with the value found, otherwise it will use the value set for `app` in the configuration property \(see table above\). |
| meta | if the record contains a key called `meta`, it will populate the context `meta` with the value found. |
| `level` | If the record contains a key called `level` or `severity`, it will populate the context `level` key with that value. If not found, the context key is not set. |
| `file` | If the record contains a key called `file`, it will populate the context `file` with the value found. Otherwise, if the plugin configuration provided a `file` property, that value will be used instead. |
| `app` | If the record contains a key called `app`, it will populate the context `app` with the value found, otherwise it will use the value set for `app` in the configuration property. |
| `meta` | if the record contains a key called `meta`, it will populate the context `meta` with the value found. |

## Getting Started
## Example configuration

The following configuration example, will emit a dummy example record and ingest it on LogDNA. In your main configuration file append the following:
The following example configuration uses a `dummy` input and `logdna` output.

{% tabs %}
{% tab title="fluent-bit.yaml" %}
Expand All @@ -115,13 +44,13 @@ The following configuration example, will emit a dummy example record and ingest
service:
flush: 1
log_level: info

pipeline:
inputs:
- name: dummy
dummy: '{"log":"a simple log message", "severity": "INFO", "meta": {"s1": 12345, "s2": true}, "app": "Fluent Bit"}'
samples: 1

outputs:
- name: logdna
match: '*'
Expand Down Expand Up @@ -182,8 +111,8 @@ Fluent Bit output:

Your record will be available and visible in your LogDNA dashboard after a few seconds.

### Query your Data in LogDNA
### Query your data in LogDNA

In your LogDNA dashboard, go to the top filters and mark the Tags `aa` and `bb`, then you will be able to see your records as the example below:
In your LogDNA dashboard, go to the top filters and mark the Tags `aa` and `bb`, then you will be able to see your records as shown:

![](../../.gitbook/assets/logdna.png)
![LogDNA dashboard](../../.gitbook/assets/logdna.png)
1 change: 1 addition & 0 deletions vale-styles/FluentBit/Acronyms.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ exceptions:
- LLVM
- LTS
- LTSV
- MAC
- MQTT
- MSK
- NET
Expand Down
1 change: 1 addition & 0 deletions vale-styles/FluentBit/Headings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ exceptions:
- Kubernetes
- LaunchDarkly
- Linux
- LogDNA
- LTSV
- macOS
- Marketplace
Expand Down