diff --git a/output/splunk/fluent-bit-configmap.yaml b/output/splunk/fluent-bit-configmap.yaml new file mode 100644 index 0000000..e8f1b52 --- /dev/null +++ b/output/splunk/fluent-bit-configmap.yaml @@ -0,0 +1,102 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: fluent-bit-config + namespace: logging + labels: + k8s-app: fluent-bit +data: + # Configuration files: server, input, filters and output + # ====================================================== + fluent-bit.conf: | + [SERVICE] + Flush 1 + Log_Level info + Daemon off + Parsers_File parsers.conf + HTTP_Server On + HTTP_Listen 0.0.0.0 + HTTP_Port 2020 + + @INCLUDE input-kubernetes.conf + @INCLUDE filter-kubernetes.conf + @INCLUDE output-splunk.conf + + input-kubernetes.conf: | + [INPUT] + Name tail + Tag kube.* + Path /var/log/containers/*.log + Parser docker + DB /var/log/flb_kube.db + Mem_Buf_Limit 5MB + Skip_Long_Lines On + Refresh_Interval 10 + + filter-kubernetes.conf: | + [FILTER] + Name kubernetes + Match kube.* + Kube_URL https://kubernetes.default.svc.cluster.local:443 + Merge_Log On + K8S-Logging.Parser On + + output-splunk.conf: | + [OUTPUT] + Name splunk + Match * + Host 127.0.0.1 + port 8088 + TLS On + TLS.Verify Off + Message_Key conf_key + + parsers.conf: | + [PARSER] + Name apache + Format regex + Regex ^(?[^ ]*) [^ ]* (?[^ ]*) \[(?