0

Using fluentd I wanted to change the "source" field value but not sure how to go about it.

Currently it is picking up the container IP address as "source" but I need that to be a self-defined name.

Any ideas?

EDIT:

Things I tried:

  1. This is a Alpine container running on Fargate ECS so setting the hostname value in the task definition.

Error: ClientException: hostname is not supported on container when networkMode=awsvpc.

  1. Use record transformer to set the hostname/source.
    <filter foo.**>
      @type record_transformer
      <record>
        hostname "foo-#{Socket.gethostname}"
      </record>
    </filter>

Also

    <filter foo.**>
      @type record_transformer
      <record>
        source "foo-#{Socket.gethostname}"
      </record>
    </filter>

No change in the records at all but I can see in the logs the filter being read and gethostname is working.

So looking further at record_transformer I have been able to write a new field with this config:

<filter foo.**>
  @type record_transformer
  <record>
    server "foo-#{Socket.gethostname}"
  </record>
</filter>

How do I change the contents of an existing field?

  1. How about this one:
<filter foo.**>
  @type record_modifier
  <replace>
    key source
    expression /[\s\S]*/
    replace "foo-#{Socket.gethostname}"
  </replace>
</filter>

The "source" field should it contain anything its contents should replaced with "foo-#{Socket.gethostname}" only it doesn't.

SnazzyBootMan
  • 669
  • 2
  • 15
  • 30

0 Answers0