0

I'm trying to use fluent-bit to ship logs from log files to telegraf which's listening on a port 8094. I'm able to send data to this port via terminal like this

echo "some_log_data" | nc localhost 8094

but when I'm using fluent-bit formward output plugin to send data to the same port, it's giving this error in the fluent-bit logs

fluent-bit_1 | [2019/11/21 11:14:44] [error] [io] TCP connection failed: localhost:8094 (Connection refused)
fluent-bit_1 | [2019/11/21 11:14:44] [error] [out_fw] no upstream connections available

This's my docker-compose file:

version: '3'

services:
  # Define a Telegraf service
  telegraf:
    image: telegraf
    volumes:
      - ./telegraf/telegraf.conf:/etc/telegraf/telegraf.conf:ro
    ports:
      - "8092:8092/udp"
      - "8094:8094"
      - "8125:8125/udp"
      - "9126:9126"
    networks:
      - mynet

  fluent-bit:
    image: fluent/fluent-bit:1.3.2-debug
    volumes:
      - ./fluent-bit:/fluent-bit/etc
      - ./access_logs/localhost_access_log:/logs
    depends_on:
      - telegraf
    networks:
      - mynet

networks:
  mynet:

fluent-bit.conf:

[SERVICE]
    Flush           2
    Parsers_File    parsers.conf

[INPUT]
    Name                tail
    Tag                 cuic.logs
    Path                /logs/*.log
    Path_Key            File_Path
    Multiline           On
    Parser_Firstline    start

[OUTPUT]
    Name          forward
    Match         *
    Host          localhost
    Port          8094
    Tag           cuic.logs

telegraf.conf:

[[outputs.file]]
  files = ["/tmp/metrics.out"]
  data_format = "json"
  json_timestamp_units = "1s"

[[inputs.socket_listener]]
  service_address = "tcp://:8094"
  socket_mode = "777"
  data_format = "grok"
  grok_patterns = ["%{CUSTOM_LOG}"]
  grok_custom_patterns = '''
    SOME_GROK_PATTERN
    '''

[[aggregators.histogram]]
 period = "10s"
 drop_original = false
 [[aggregators.histogram.config]]
   buckets = [0.0, 10.0, 20.0, 30.0, 40.0, 50.0, 60.0, 70.0, 80.0, 90.0, 100.0]
   measurement_name = "access_log"
   fields = ["resp_time"]

Can someone please help me figure out what I did wrong?

megamind79
  • 69
  • 3
  • 11

3 Answers3

0

I think the problem is when using the hostname "localhost". For the container localhost at a network level will be its own network scope, it won't be able to access the other container TCP Port as desired.

You can read more about the same problem here:

How to share localhost between two different Docker containers?

and... note that Forward output protocol in Fluent Bit uses a binary protocol as opposed to the normal JSON that I suspect you want to use. Use the tcp output plugin instead.

edsiper
  • 398
  • 1
  • 4
0

It's definitely the output/input plugins you are using. Telegraf has a FluentD plugin here, and it looks like this:

    # Read metrics exposed by fluentd in_monitor plugin
[[inputs.fluentd]]
  ## This plugin reads information exposed by fluentd (using /api/plugins.json endpoint).
  ##
  ## Endpoint:
  ## - only one URI is allowed
  ## - https is not supported
  endpoint = "http://localhost:24220/api/plugins.json"

  ## Define which plugins have to be excluded (based on "type" field - e.g. monitor_agent)
  exclude = [
      "monitor_agent",
      "dummy",
  ]

Your Fluent-Bit http output config would look like this:

[INPUT]
    Name  cpu
    Tag   cpu

[OUTPUT]
    Name  http
    Match *
    Host  192.168.2.3
    Port  80
    URI   /something

But Fluent-Bit also has an InfluxDB output plugin.

Shōgun8
  • 482
  • 10
  • 20
0

Fluent-bit has an out plugin named forward, it can forward the output according to fluentd protocol. You can set up it according to this doc: https://docs.fluentbit.io/manual/pipeline/inputs/forward

Then, you can find the telegraf has an input plugin named fluentd, set it as input and then gather metrics from the fluentd client endpoint which can fulfill your requirement.

Jie Yin
  • 560
  • 5
  • 9