使用 fluent-plugin-grok-parser 和 splunk-hec 图像答案

【问题标题】：Use fluent-plugin-grok-parser with splunk-hec image使用 fluent-plugin-grok-parser 和 splunk-hec 图像
【发布时间】：2021-01-12 14:57:06
【问题描述】：

我正在尝试创建一个基于 fluentd-hec 图像安装了 grok-parser 的图像。

这是我正在使用的 Dockerfile：

FROM splunk/fluentd-hec:1.2.4
USER root
RUN gem install fluent-plugin-grok-parser
RUN chown -R fluent:fluent /usr/local/share/gems/gems/fluent-plugin-grok-parser-*
USER fluent

这是该构建的输出


Step 1/5 : FROM splunk/fluentd-hec:1.2.4
 ---> ac49b85acc6a
Step 2/5 : USER root
 ---> Running in 4ee81880e92a
Removing intermediate container 4ee81880e92a
 ---> e3748059e604
Step 3/5 : RUN gem install fluent-plugin-grok-parser
 ---> Running in 2a1debb084ec
Successfully installed bundler-2.2.5
Building native extensions. This could take a while...
Successfully installed msgpack-1.3.3
Building native extensions. This could take a while...
Successfully installed yajl-ruby-1.4.1
Building native extensions. This could take a while...
Successfully installed cool.io-1.7.0
Successfully installed sigdump-0.2.4
Successfully installed serverengine-2.2.2
Building native extensions. This could take a while...
Successfully installed http_parser.rb-0.6.0
Successfully installed concurrent-ruby-1.1.7
Successfully installed tzinfo-2.0.4
Successfully installed tzinfo-data-1.2020.6
Building native extensions. This could take a while...
Successfully installed strptime-0.2.5
Successfully installed fluentd-1.12.0
Successfully installed fluent-plugin-grok-parser-2.6.2
13 gems installed
Removing intermediate container 2a1debb084ec
 ---> c5155932810c
Step 4/5 : RUN chown -R fluent:fluent /usr/local/share/gems/gems/fluent-plugin-grok-parser-*
 ---> Running in 1c2550dcac74
Removing intermediate container 1c2550dcac74
 ---> 7e216a676427
Step 5/5 : USER fluent
 ---> Running in 5ee31ea2e78a
Removing intermediate container 5ee31ea2e78a
 ---> ea8bdee73ee5
Successfully built ea8bdee73ee5

configmap的sn-p是：

      @id snow
      @type tail
      @label @SPLUNK
      tag tail.snow.*
      path /opt/snow/data/*.log
      pos_file /var/log/splunk-snow.log.pos
      path_key source
      <parse>
        @type grok
        grok_failure_key grokfailure
        <grok>
          pattern %{TIMESTAMP_ISO8601:time};%{SPACE}%{GREEDYDATA:log}
        </grok>
      </parse>
    </source>

当我使用新映像部署守护程序集时出现错误 config error file="/fluentd/etc/fluent.conf" error_class=Fluent::ConfigError error="Unknown parser plugin 'grok'. Run 'gem search -rd fluent-plugin' to find plugins" 我已经在 EKS v1.18 和 docker desktop 中尝试过，它们都有同样的问题。

还有什么我需要添加到 dockerfile 以便我使用额外的插件吗？

如果能提供任何帮助，我将不胜感激！

【问题讨论】：

标签： splunk fluentd grok

【解决方案1】：

我已经重写了配置，所以没有使用 grok，所以不再需要这个问题了

【讨论】：