Fluentd is working but no index is being created on elastcisearch

12/30/2019

I have a Kubernetes pod java app (writes logs to file on volume host (/var/log/java-app/java.log )) and use Fluentd as daemon sets that tails log file and writes to Elasticsearch. My fluentd is working but no index is being created on the elastic search and no index is showing on kibana.

Here is the Fluentd configuration:

javaapp.conf: |
<source>
  @type tail
  path /var/log/java-app/java.log
  pos_file /var/log/java-apps.log.pos
  tag java.app
  read_from_head true
  <parse>
    @type json
    time_format %Y-%m-%dT%H:%M:%S.%NZ
  </parse>
</source>

 # we send the logs to Elasticsearch
<match java.**>
   @type elasticsearch_dynamic
   @log_level info
   include_tag_key true
   host "#{ENV['FLUENT_ELASTICSEARCH_HOST']}"
   port "#{ENV['FLUENT_ELASTICSEARCH_PORT']}"
   user "#{ENV['FLUENT_ELASTICSEARCH_USER']}"
   password "#{ENV['FLUENT_ELASTICSEARCH_PASSWORD']}"
   scheme "#{ENV['FLUENT_ELASTICSEARCH_SCHEME'] || 'http'}"
   ssl_verify "#{ENV['FLUENT_ELASTICSEARCH_SSL_VERIFY'] || 'true'}"
   reload_connections true
   logstash_format true
   logstash_prefix java-app-logs
   <buffer>
       @type file
       path /var/log/fluentd-buffers/java-app.system.buffer
       flush_mode interval
       retry_type exponential_backoff
       flush_thread_count 2
       flush_interval 5s
       retry_forever true
       retry_max_interval 30
       chunk_limit_size 2M
       queue_limit_length 32
       overflow_action block
   </buffer>
</match>

Version of Fluentd version : fluent/fluentd-kubernetes-daemonset:v1.1-debian-elasticsearch Version of Elasticsearch version: docker.elastic.co/elasticsearch/elasticsearch:7.3.0

Looks like Fluentd does not get to put the logs into Elasticsearch.

-- Anup
elasticsearch
fluentd
kibana
kubernetes
logging

0 Answers