From 574131b5bc6c7b8092d3e9136cd4ae451f336a7e Mon Sep 17 00:00:00 2001
From: Junwei Zhao <wahyd4@gmail.com>
Date: Sat, 18 Feb 2023 08:53:04 +1100
Subject: [PATCH] Collect /var/log to es through fluent bit

---
 manifests/fluent-bit.yaml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/manifests/fluent-bit.yaml b/manifests/fluent-bit.yaml
index bff49fb..aca81ec 100644
--- a/manifests/fluent-bit.yaml
+++ b/manifests/fluent-bit.yaml
@@ -226,7 +226,14 @@ spec:
                 Docker_Mode        On
                 Docker_Mode_Flush  5
                 Docker_Mode_Parser docker
-
+            [INPUT]
+                Name          exec
+                Tag           host_exec.*
+                Command       ls /var/log
+                Interval_Sec  5
+                Interval_NSec 0
+                Buf_Size      8mb
+                Oneshot       false
             [INPUT]
                 Name systemd
                 Tag host.*
@@ -338,6 +345,15 @@ spec:
                 Retry_Limit 20
                 Replace_Dots    On
                 Suppress_Type_Name On
+            [OUTPUT]
+                Name es
+                Match host_exec.*
+                Host elasticsearch.es.svc.cluster.local
+                Port 9200
+                Index logs-node.%Y%m
+                Retry_Limit 20
+                Replace_Dots    On
+                Suppress_Type_Name On
 
           ## https://docs.fluentbit.io/manual/pipeline/parsers
           customParsers: |