I have a Kubernetes pod java app (writes logs to file on volume host (/var/log/java-app/java.log )) and use Fluentd as daemon sets that tails log file and writes to Elasticsearch. My fluentd is working but no index is being created on the elastic search and no index is showing on kibana.
Here is the Fluentd configuration:
javaapp.conf: |
<source>
@type tail
path /var/log/java-app/java.log
pos_file /var/log/java-apps.log.pos
tag java.app
read_from_head true
<parse>
@type json
time_format %Y-%m-%dT%H:%M:%S.%NZ
</parse>
</source>
# we send the logs to Elasticsearch
<match java.**>
@type elasticsearch_dynamic
@log_level info
include_tag_key true
host "#{ENV['FLUENT_ELASTICSEARCH_HOST']}"
port "#{ENV['FLUENT_ELASTICSEARCH_PORT']}"
user "#{ENV['FLUENT_ELASTICSEARCH_USER']}"
password "#{ENV['FLUENT_ELASTICSEARCH_PASSWORD']}"
scheme "#{ENV['FLUENT_ELASTICSEARCH_SCHEME'] || 'http'}"
ssl_verify "#{ENV['FLUENT_ELASTICSEARCH_SSL_VERIFY'] || 'true'}"
reload_connections true
logstash_format true
logstash_prefix java-app-logs
<buffer>
@type file
path /var/log/fluentd-buffers/java-app.system.buffer
flush_mode interval
retry_type exponential_backoff
flush_thread_count 2
flush_interval 5s
retry_forever true
retry_max_interval 30
chunk_limit_size 2M
queue_limit_length 32
overflow_action block
</buffer>
</match>
Version of Fluentd version : fluent/fluentd-kubernetes-daemonset:v1.1-debian-elasticsearch Version of Elasticsearch version: docker.elastic.co/elasticsearch/elasticsearch:7.3.0
Looks like Fluentd does not get to put the logs into Elasticsearch.