currently we have solution in place for sending container logs from k8s clusters to splunk but unable to send control plane and worker node logs to splunk using fluent-bit
custom_parsers.conf: |
[PARSER]
Name docker_no_time
Format json
Time_Keep Off
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
fluent-bit.conf: |
[SERVICE]
Daemon Off
Flush 1
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
[INPUT]
Name tail
Path /var/log/containers/*.log
Exclude_Path /var/log/containers/*_fluent-bit_*.log
multiline.parser docker, cri
Tag kube.*
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[INPUT]
Name tail
Path /var/log/journal/*/*.joural
Tag journald
[OUTPUT]
Name splunk
Match *
Host myhost
Port '8088'
event_index my_index
Splunk_Token splunk_token
net.max_worker_connections 5
tls On
tls.verify Off
Tried with the above config but unable to send logs in splunk, only seeing container logs