This article is available in French.
1. Le pipeline #
Six étapes.
Concepts #
| Étape | Rôle |
|---|---|
| Input | Lit les données et leur attribue un tag (par exemple kube.*) |
| Parser | Transforme une ligne brute en enregistrement structuré |
| Filter | Enrichit, modifie ou supprime des enregistrements |
| Buffer | Stocke en mémoire ou sur disque avant l'envoi |
| Router | Associe tags et outputs via match |
| Output | Envoie vers la destination, avec réessais |
2. La configuration YAML #
Le format recommandé.
Exemple complet #
service:
flush: 1
log_level: info
http_server: on # métriques et santé sur le port 2020
http_listen: 0.0.0.0
http_port: 2020
storage.path: /var/lib/fluent-bit/buffer
parsers:
- name: app_json
format: json
time_key: ts
time_format: '%Y-%m-%dT%H:%M:%S.%LZ'
pipeline:
inputs:
- name: tail
path: /var/log/app/*.log
tag: app.*
parser: app_json
db: /var/lib/fluent-bit/tail.db # positions de lecture
mem_buf_limit: 50MB
storage.type: filesystem
filters:
- name: grep
match: app.*
exclude: path ^/health
- name: modify
match: app.*
add: [env production]
remove: password
outputs:
- name: loki
match: app.*
host: loki
port: 3100
labels: job=fluent-bit, env=production
- name: es
match: app.*
host: elasticsearch
port: 9200
logstash_format: on
suppress_type_name: onfluent-bit -c fluent-bit.yaml
fluent-bit -c fluent-bit.yaml --dry-run # valider sans démarrerÀ savoir : L'ancien format « classique » (sections[INPUT],[OUTPUT]) reste pris en charge ; le YAML est recommandé pour les nouvelles installations.
3. Plugins essentiels #
Ceux qu'on utilise partout.
Sélection #
| Type | Plugin | Usage |
|---|---|---|
| Input | tail | Fichiers (dont les logs de conteneurs) |
| Input | systemd | Journal systemd |
| Input | forward, opentelemetry | Réception depuis Fluentd/Fluent Bit ou en OTLP |
| Filter | kubernetes | Ajoute namespace, pod, labels, annotations |
| Filter | grep, modify, nest | Filtrer, renommer, restructurer |
| Filter | lua | Transformation libre en Lua |
| Filter | rewrite_tag | Re-router selon le contenu |
| Output | loki, es, opensearch | Stockage des logs |
| Output | s3, kafka, opentelemetry | Archivage, bus, OTLP |
My progress
Sign in to track your progress and take notes. Sign in
Recommended Articles
Understanding the concept of score
The concept of score allows Elasticsearch to rank your documents by relevance during a search.
Understanding the Elastic Common Schema (ECS)
As always in our consulting engagements, we recommend that companies harmonise and standardise: k...
License consumption types
Understand the evolution of billing in Dynatrace: the difference between the old licensing model ...
Grafana Alloy: The importance of Self-Monitoring
Discover why and how to configure Grafana Alloy so that it monitors itself, collecting its own lo...
Grafana Alloy: Understanding and exploiting the User Interface (UI)
Discover how to enable, secure, and use Grafana Alloy's built-in web interface to visualize your ...
Grafana Alloy: Introduction and Architecture
Discover the fundamental concepts of Grafana Alloy, the transition from the static Agent to Alloy...
Grafana Alloy: Syntax and Configuration (Alloy Language: River)
As part of a Grafana training or observability training, master the declarative syntax of Grafana...
Grafana Alloy: Metrics Collection (Prometheus & Ecosystem)
Learn how to configure Grafana Alloy to collect, transform, and forward metrics using the Prometh...
Grafana Alloy: Log Management with Loki
Discover how to configure Grafana Alloy to read log files, journald, or network streams, process ...