Closed mimachniak closed 5 years ago
Could you share your configuration?
Sure, I'm useing wWindows 2012 R2 with this configuration,
# Output descriptions:
# Treasure Data (http://www.treasure-data.com/) provides cloud based data
# analytics platform, which easily stores and processes data from td-agent.
# FREE plan is also provided.
# @see http://docs.fluentd.org/articles/http-to-td
# This section matches events whose tag is td.DATABASE.TABLE
<match td..>
@type tdlog
@id output_td
apikey YOUR_API_KEY
auto_create_table
@type file
path /var/log/td-agent/buffer/td
@type file
path /var/log/td-agent/failed_records
## match tag=debug. and dump to console
<match debug.>
@type stdout
@id output_stdout
## Source descriptions:
## built-in TCP input
## @see http://docs.fluentd.org/articles/in_forward
@type forward
@id input_forward
## built-in UNIX socket input
#
# type unix
#
# HTTP input
# POST http://localhost:8888/
# POST http://localhost:8888/td.myapp.login?json={"user"%3A"me"}
# @see http://docs.fluentd.org/articles/in_http
@type http
@id input_http
port 8888
## live debugging agent
@type debug_agent
@id input_debug_agent
bind 127.0.0.1
port 24230
## windows_eventlog
@type windows_eventlog
@id windows_eventlog
channels application,system
read_interval 2
tag winevt.raw
@type local # @type local is the default.
persistent true # default is true. Set to false to use in-memory storage.
path ./tmp/storage.json # This is required when persistent is true.
# Or, please consider using
And this I get when start process:
4:06:11 -0700 [info]: parsing config file is succeeded path="C:/opt/td-agent/etc/td-agent/td-agent.conf"
2018-10-07 04:06:12 -0700 [warn]: [output_td] secondary type should be same with primary one primary="Fluent::Plugin::TreasureDataLogOutput" secondary="Fluent::Plugin::FileOutput"
2018-10-07 04:06:12 -0700 [info]: using configuration file:
<secondary>
@type "file"
path "/var/log/td-agent/failed_records"
<buffer time>
path /var/log/td-agent/failed_records
</buffer>
</secondary>
<match debug.**> @type stdout @id output_stdout
@type forward
@id input_forward
@type http
@id input_http
port 8888
@type debug_agent
@id input_debug_agent
bind "127.0.0.1"
port 24230
@type windows_eventlog
@id windows_eventlog
channels application,system
read_interval 2
tag "winevt.raw"
<storage>
@type "local"
persistent true
path "./tmp/storage.json"
</storage>
You can use winevt.raw
pattern like the following:
<match winevt.raw>
@type stdout
@id output_stdout
</match>
Otherwise, winevt.raw
is not handled in your configuration.
Default configuration does not handle winevt.raw
.
Apparently this question has been multiposted. So I'll close this one.
https://github.com/fluent/fluent-plugin-windows-eventlog/issues/12
When I lunch fluentd with configuration I get this message
0 no patterns matched tag="winevt.raw"