eeddaann/fluent-plugin-loki

Fluntd output plugin to Grafana Loki

fluent-plugin-loki

Fluentd output plugin to Grafana Loki.

• Can be used to ship docker logs to Loki (using Fluentd docker logging driver)
• Enable easier transtion to Loki - an alternative to Loki's Promtail

Installation

RubyGems

$ gem install fluent-plugin-loki

Configuration

sample configuration:

<match *>
  @type loki
  endpoint_url    http://127.0.0.1:3100
  labels          {"env":"prod","farm":"a"} # default: nil
  tenant          abcd           # default: nil
  rate_limit_msec 100            # default: 0 = no rate limiting
  raise_on_error  false          # default: true
  authentication  basic          # default: none
  username        alice          # default: ''
  password        bobpop         # default: '', secret: true
  buffered        true           # default: false. Switch non-buffered/buffered mode
  cacert_file     /etc/ssl/endpoint1.cert # default: ''
  token           tokent         # default: ''
  custom_headers  {"token":"arbitrary"} # default: nil
</match>

• endpoint_url - Loki's endpoint
• tenant - Loki tenant id
• labels - Labels for filtering in Grafana (currently they are static)

(generated by running: fluent-plugin-config-format output loki -p lib/fluent/plugin)

Usage examples for common fluentd inputs:

syslog

Setting up rsyslog Open /etc/rsyslog.d/50-default.conf and append the following line: *.* @127.0.0.1:5140 Then restart the rsyslogd service: sudo systemctl restart syslog sample fluentd config:

<source>
  @type syslog
  port 5140
  bind 0.0.0.0
  tag system
</source>

simulate data: logger "came from syslog"

file

sample fluentd config:

## File input
## read apache logs with tag=apache.access
#<source>
#  @type tail
#  format apache
#  path /var/log/httpd-access.log
#  tag apache.access
#</source>

HTTP

sample fluentd config:

# HTTP input
# http://localhost:8888/<tag>?json=<json>
# for ex: http://localhost:8888/baz?json={"src":"http"}
<source>
  @type http
  @id http_input

  port 8888
</source>

simulate data:

curl -X POST -d 'json={"src":"http"}' http://localhost:8888

tcp

sample fluentd config:

## built-in TCP input
## $ echo <json> | fluent-cat <tag>
<source>
  @type forward
  @id forward_input
</source>

simulate data:

echo '{"src":"tcp"}' | fluent-cat tcp

Development (using Docker)

• Set up Loki and Grafana (can be done by running their docker-compose)
• Add loki data source to grafana
• Run Fluentd container with volume mapping to the dummy configuration and to the plugin:

docker run -d \
  -p 9880:9880 \
  -v $(pwd)/development/conf:/fluentd/etc \
  -v $(pwd)/lib/fluent/plugin:/etc/fluent/plugin -e FLUENTD_CONF=fluentd.conf \
  fluent/fluentd

• Execute to send log: curl -X POST -d 'json={"foo":"baz"}' http://localhost:9880

Copyright

• Copyright(c) 2018- Edan Shahmoon
• License
  • Apache License, Version 2.0

Heavily based on fluent-plugin-out-http

fluent-plugin-loki's Issues

Mistaken/dubious README.md sample configuration

Maybe I am mistaken, but shouldn't the @type line in the README.md file be loki instead of http?

I have not used this plugin, I was trying to understand how to use it, and I still am not sure if there's that mistake or I am missing something big.

naming conflict with official fluent-plugin-loki

Hi @eeddaann

we appreciate the work you do and open sourcing it! Unfortunately, there is a naming conflict with the fluent-plugin-loki developed within the loki repositories:

• https://github.com/grafana/loki/tree/master/fluentd/fluent-plugin-loki

Since this is hard to spot and confuses people when following the official loki guide on setting up fluent-plugin-loki, I wonder if you would mind changing the name of your gem file?

Best

Authentication is not working from fluentd-->Loki-->Grafana

Configuration File Details

Fluentd
File: /etc/td-agent/td-agent.conf

<match huge.log>
  @type loki
  format json
  url "http://localhost:3100"
  username test
  password test

  <buffer>
    @type memory
    chunk_limit_size 8m
    compress gzip
  </buffer>

  flush_at_shutdown true
  flush_mode interval
  flush_interval 5s
  flush_thread_count 10

  extra_labels {"job":"huge.log", "host":"workstation_hl_new", "agent":"fluentd_hl_new" }
  <label>
      filename
  </label>
</match>

Loki
File: loki-local-config.yaml

auth_enabled: true

Grafana:

Under loki datasource Basic Auth Details given

Expected:
Able to communicate through Authentication.

Actual Error in Grafana

logger=context userId=1 orgId=1 uname=admin t=2022-11-29T14:56:15.50091764+05:30 level=error msg="Failed to call resource" error="no org id\n" traceID=
logger=context userId=1 orgId=1 uname=admin t=2022-11-29T14:56:15.501022502+05:30 level=error msg="Request Completed" method=GET path=/api/datasources/5/resources/labels status=500 remote_addr=[::1] time_ms=1 duration=1.690432ms size=51 referer=http://localhost:3000/datasources/edit/EWm6GTdVz handler=/api/datasources/:id/resources/*
``

Using Loki plugin for other input than docker

Hi,

Is this plugin could be use with any input plugin from fluentd?

Using for example the syslog input and Loki output?

How the labels are added if not docker logging driver?

Thanks

Add tests and CI based on fluentd's http plugin