0

I want to get help.

There is a message as below.

The message is being received and saved to a file.

I want to display the time in the file name, but it's failing.

Env

td-agent 4.3.1 fluentd 1.14.6

Input message

{
...
  "kubernetes": {
    "host": "w1.test.local",
...
  },
  "message": "2022-07-10T13:41:22.6618971657458345+00:00 w1 w1.test.local haproxy[825]: 192.168.7.251:55047 [10/Jul/2022:13:41:22.660] ... \"GET /index.jsp?111222 HTTP/1.1\"
  "@timestamp": "2022-07-10T13:41:22.661974+00:00",
...

<match **>
  @type file
  path /logs/test-${$.kubernetes.host}

  <buffer time,$.kubernetes.host>
    path /logs/buffer/w1
    flush_mode interval
    flush_interval 1s
  </buffer>

  time_slice_format %Y%m%dT%H
  flush_interval 1s
  append true
  <format>
    @type single_value
    message_key message
  </format>
</match>

The time is always 00 /logs/test-w1.test.local.20220710T00.log

Can't express time?

Thank you.

ddakker
  • 55
  • 7

1 Answers1

0

I solved it as follows, but it is the server time received.

<filter **>
 @type record_transformer
 enable_ruby
 <record>
  time-filename ${Time.new.strftime("%Y%m%d%H")}
 </record>
</filter>

<match **>
  @type file
  path /logs/test-${$.kubernetes.host}.${$.time-filename}


#  time_slice_format %Y%m%d
#  time_slice_format %Y%m%dT%H
  flush_interval 1s
  append true
  <format>
    @type single_value
    message_key message
  </format>

  <buffer $.time-filename,$.server-type,$.kubernetes.host>
    path /logs/buffer/w1
    flush_mode interval
    flush_interval 1s
  </buffer>
</match>
ddakker
  • 55
  • 7