Closed widgetpl closed 7 years ago
It will not work as hostname
does not support ${tag_parts}
.
I am having this same issue with the td-agent enterprise edition. My config file works just fine with the open source version, not the commercial version. I am trying to use ${tag_parts[x]} to set sourcetype and index in the splunk hec output plugin.
<match {us,last_chance_predix}> @type splunk_hec host splunkserver.com port 8088 token D76AA0AC-EE4886867-YTYTY-974646 default_host "#{Socket.gethostname}" default_source fluentd default_index ${tag_parts[0]} sourcetype ${tag_parts[1]}
My docker-compose manifest looks like
and I have tried two differnt
fluentd
configs. Firstand second
and I have this setup for rsyslog
When I use First config of fluentd i get
and the logs are in in
/var/log/logs/env-192.168.0.101/docker.michal-Latitude-E6540.log
and whit second config
and the logs are in
/var/log/logs/fluentd.stack261_default/${tag_parts.log