salt.log_handlers.fluent_mod¶

Fluent Logging Handler¶

In the fluent configuration file:

<source>
  type forward
  bind localhost
  port 24224
</source>

Then, to send logs via fluent in Logstash format, add the following to the salt (master and/or minion) configuration file:

fluent_handler:
  host: localhost
  port: 24224

To send logs via fluent in the Graylog raw json format, add the following to the salt (master and/or minion) configuration file:

fluent_handler:
  host: localhost
  port: 24224
  payload_type: graylog
  tags:
  - salt_master.SALT

The above also illustrates the tags option, which allows one to set descriptive (or useful) tags on records being sent. If not provided, this defaults to the single tag: 'salt'. Also note that, via Graylog "magic", the 'facility' of the logged message is set to 'SALT' (the portion of the tag after the first period), while the tag itself will be set to simply 'salt_master'. This is a feature, not a bug :)

Note: There is a third emitter, for the GELF format, but it is largely untested, and I don't currently have a setup supporting this config, so while it runs cleanly and outputs what LOOKS to be valid GELF, any real-world feedback on its usefulness, and correctness, will be appreciated.