td-agent如何向fluentd发送haproxy日志？

Question

我想使用td-agent将haproxy日志发送到fluentd/elasticsearch/kibana，但无法正确操作

我已经通过dockers安装了EFK，它的规则是正确的。我有一个日志类型为haproxy.tcp的haproxy，如下所示：

haproxy[27508]: info 127.0.0.1:45111 [12/Jul/2012:15:19:03.258] wss-relay wss-relay/local02_9876 0/0/50015 1277 cD 1/0/0/0/0 0/0

我的td-agent.conf是这样的：

<source>
  @type tail
  path /var/log/haproxy.log
  format /^(?<ps>\w+)\[(?<pid>\d+)\]: (?<pri>\w+) (?<c_ip>[\w\.]+):(?<c_port>\d+) \[(?<time>.+)\] (?<f_end>[\w-]+) (?<b_end>[\w-]+)\/(?<b_server>[\w-]+) (?<tw>\d+)\/(?<tc>\d+)\/(?<tt>\d+) (?<bytes>\d+) (?<t_state>[\w-]+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srv_conn>\d+)\/(?<retries>\d+) (?<srv_queue>\d+)\/(?<backend_queue>\d+)$/
  tag haproxy.tcp
  time_format %d/%B/%Y:%H:%M:%S
</source>
<match haproxy.tcp>
  @type forward
  <server>
    host dockerdes01
    port 24224
  </server>
</match>

但是日志不会到达/var/ log /td-agent/td-agent.log

如果我使用这个：

<match haproxy.tcp>
  @type copy
  <store>
    @type stdout
  </store>
  <store>
    @type elasticsearch
    logstash_format true
    flush_interval 10s # for testing.
    host dockerdes01
    port 9200
  </store>
</match>

我在我的/var/log/td-agent/td-agent.log中看到：

2012-07-12 15:19:03.000000000 +0200 haproxy.tcp: {"ps":"haproxy","pid":"27508","pri":"info","c_ip":"127.0.0.1","c_port":"45111","f_end":"wss-relay","b_end":"wss-relay","b_server":"local02_9876","tw":"0","tc":"0","tt":"50015","bytes":"1277","t_state":"cD","actconn":"1","feconn":"0","beconn":"0","srv_conn":"0","retries":"0","srv_queue":"0","backend_queue":"0"}

但它并不能流畅地到达……

我需要日志到达fluentd

Answer 1

最好将syslog设置为fluentd，并使用syslog从haproxy发送。