fluent-bit.conf

# This provides prometheus metrics

[SERVICE]
    HTTP_Server  On
    HTTP_Listen  0.0.0.0
    HTTP_PORT    2020

[INPUT]
    Name cpu
    Tag  local.cpu
    Interval_Sec 1

[INPUT]
    Name mem
    Tag  local.mem
    Interval_Sec 1

# This implements the heartbeat function

[INPUT]
    Name   dummy
    Tag    sys.heartbeat
    Dummy  {"event":{"heartbeat":"heartbeat"}}
    Rate   1

# Filters are applied in order
#
# Applying the filter below it becomes,
# {
#   "index"      : "fluentbit_demo",
#   "sourcetype" : "fluentbit-heartbeat",
#   "event"      : {
#     "heartbeat" : "heartbeat"
#   }
# }

[FILTER]
    Name    modify
    Match   sys.heartbeat
    Set     sourcetype fluentbit-heartbeat
    Set     index fluentbit_demo

# This 'nest' takes all key values pairs in a record and places them under the
# 'event' key, which is the Splunk HEC format

# Whith the filter below, this input,
#
# {
#   "key1" : "value1",
#   "key2" : "value2"
# }
#
# Becomes,
# {
#   "event" : {
#     "key1" : "value1",
#     "key2" : "value2"
#   }
# }

[FILTER]
    Name       nest
    Match      local.*

    Operation  nest
    Wildcard   *
    Nest_under event

[FILTER]
    Name    modify
    Match   local.cpu

    Add_if_not_present     sourcetype cpustats

[FILTER]
    Name    modify
    Match   local.mem

    Add_if_not_present     sourcetype memstats

# Add defaults if none are set.

# Whith the filter below, this input,
# {
#   "event" : {
#     "key1" : "value1",
#     "key2" : "value2"
#   }
# }

# Becomes,
# {
#   "index"      : "fluentbit_demo",
#   "sourcetype" : "json",
#   "hostname"   : "example.local",
#   "event"      : {
#     "key1" : "value1",
#     "key2" : "value2"
#   }
# }

[FILTER]
    Name    modify
    Match   local.*

    Add_if_not_present     sourcetype _json
    Add_if_not_present     index fluentbit_demo
    Add_if_not_present     hostname ${HOSTNAME}

# Move items to indexed fields
# Whith the filter below, this input,
# {
#   "index"      : "fluentbit_demo",
#   "sourcetype" : "json",
#   "hostname"   : "example.local",
#   "event"      : {
#     "key1" : "value1",
#     "key2" : "value2"
#   }
# }

# Becomes,
# {
#   "index"      : "fluentbit_demo",
#   "sourcetype" : "json",
#   "fields"     : {
#     "hostname"   : "example.local",
#   },
#   "event"      : {
#     "key1" : "value1",
#     "key2" : "value2"
#   }
# }

[FILTER]
    Name       nest
    Match      local.*

    Operation  nest
    Wildcard   hostname*
    Nest_under fields

# Log to STDOUT for debugging

[OUTPUT]
    Name           stdout
    Match          *

# Forward to Splunk HEC in JSON format

[OUTPUT]
    Name           http
    Match          *

    Host           envoy
    Port           8088
    Format         json_stream
    URI            /services/collector/event
    tls            Off
    json_date_key  time
    http_user      x
    http_passwd    3e6ffd12-0f69-46bb-ad0d-71cffb661a0d