Can fluentd replace rsyslog in collecting server logs?

Question

I want to collect the logs from openstack, for which i have rsyslog on the log server. This then forwards the logs to fluentd. However i want to know if the logs can directly be collected using fluentd instead of using rsyslog

Answer 1

Sure can, using Fluentd's syslog input. For example, if you wish to have Fluentd listening on port 4567 and to save the log events to locally running ElasticSearch just use the following.

<source>
   type syslog
   port 4567
   tag  rsyslog 
</source>
<match rsyslog.**>
  type copy
  <store>
    type elasticsearch
    logstash_format true
    flush_interval 10s
    host 127.0.0.1
    port 9200
  </store>
</match>

With this in place, just forward your logs to the server you have Fluentd installed in.