Fluentd?是由Ruby和C編寫的椎咧，需要ruby進行，然而安裝td-agent?是fluentd 的易安裝版本，不用考慮太多的依賴關(guān)系勤讽。
編輯配置文件/etc/td-agent/td-agent.conf 中的source來設(shè)置日志來源
<source>
?type?tail??
?format?apache ?
?path?/var/log/apache2/access_log ?
?pos_file?/var/log/apache2/access_log.pos ?
?tag?mongo.apache ?
</source>
type tail: tail方式是 Fluentd 內(nèi)置的輸入方式蟋座，其原理是不停地從源文件中獲取增量日志，與linx命令tail相似脚牍，也可以使用其他輸入方式如http向臀、forward等輸入，也可以使用輸入插件诸狭，將 tail 改為相應(yīng)的插件名稱 如： type tail_ex??券膀，注意tail_ex為下劃線
1. 使用中轉(zhuǎn)方式
先發(fā)送給中轉(zhuǎn)站，中轉(zhuǎn)再發(fā)送至elatsearch
在本機修改tdagent配置
# vim /etc/td-agent/conf.d/td-agent.conf
<source>
??type tail
??format json
??time_key time
??time_format %N
??pos_file /var/log/td-agent/x.log.pos
??path /log/x.%d.%m.%Y.log
??tag? log.x
</source>
<match log.**>
???type forward # forward模式驯遇，轉(zhuǎn)發(fā)給其他服務(wù)器處理
???send_timeout 60s
???recover_wait 10s
???heartbeat_interval 1s
???phi_threshold 16
???hard_timeout 60s
???heartbeat_type tcp
? ?<server>??
??????name auth.shard
? ? ? host?td-agent
??????port 24
??????weight 1
? </server>
? <secondary>
??????type file
??????path /var/log/td-agent/log-forward-failed
</secondary>
</match>
?在中轉(zhuǎn)修改tdagent配置
?#? vim?/etc/td-agent/conf.d/td-agent-log.conf
?<source>
?type forward
?</source>
<match log.**>
? ?type forest
? ?subtype copy
? ?<template>??
? ? ? ? ? <store>? ? ??
??????????@type elasticsearch
? ? ? ? ? ?host?elasticsearch
??????????port 92
??????????ssl_verify false
??????????logstash_format true
??????????logstash_prefix bilogs
??????????logstash_dateformat log.%m.%d.%Y
??????????time_key time
??????????flush_interval 10s
??????????request_timeout 15s
??????????reload_on_failure true
??????????reconnect_on_error true
????????</store>
????</template>
</match>
kibana上添加index? log
# cat /opt/supervisor/log/12.12.2017.log |/opt/td-agent/embedded/bin/fluent-cat log** （非中轉(zhuǎn)方式）
2. 不使用中轉(zhuǎn)方式
直接發(fā)送給elatsearch
在所要添加的服務(wù)本機
#?vim /etc/td-agent/conf.d/td-agent.conf
<match bilog.**>
? type forest
??subtype copy
? <template>
? ? ? <store>
??????????@type elasticsearch
??????????#type_name multiplayer.shard
? ? ? ? ? host?elasticsearch
? ? ? ? ? port 92?
??????????ssl_verify false
??????????logstash_format true
??????????logstash_prefix bilogs
??????????logstash_dateformat bilog%m.%d.%Y
??????????time_key time
??????????flush_interval 10s
??????????request_timeout 15s
??????????reload_on_failure true
??????????reconnect_on_error true
????????????</store>
????????</template>
</match>
# cat *json* | /opt/td-agent/embedded/bin/fluent-cat bilog**
