FluentD 實作 Error Log

本篇將介紹使用 DotNet 專案 log4net 套件，紀錄的 log
針對 Error Level 的訊息透過FluentD 提取出來
在紀錄中 增加 trace ID
設入 MongoDB , 及加入 Slack 通知

延伸閱讀

FluentD 參數說明
FluentD 實作 Nginx Access Log
FluentD 實作 Nginx Access Log 補充

---

log4net

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <log4net>
    <appender name="All" type="log4net.Appender.RollingFileAppender">
      <file value="/var/log/my.log" />
      <appendToFile value="true" />
      <rollingStyle value="Size" />
      <datePattern value="yyyy-MM-dd" />
      <maximumFileSize value="5MB" />
      <maxSizeRollBackups value="10" />
      <staticLogFileName value="true" />
      <PreserveLogFileNameExtension value="true" />
      <layout type="log4net.Layout.PatternLayout">
        <conversionPattern value="[%date] [%thread] %level %logger - %message%newline" />
      </layout>
    </appender>
    <root>
      <appender-ref ref="All" />
    </root>
  </log4net>
</configuration>

Dockerfile

FROM fluent/fluentd:v1.8.1-1.0

# Use root account to use apk
USER root

# below RUN includes plugin as examples elasticsearch is not required
# you may customize including plugins as you wish
RUN apk add --no-cache --update --virtual .build-deps \
        sudo build-base ruby-dev \
     && sudo gem install fluent-plugin-mongo \
     && sudo gem install fluent-plugin-add-uuid \
     && sudo gem install fluent-plugin-slack \
     && sudo gem sources --clear-all \
     && apk del .build-deps \
     && rm -rf /home/fluent/.gem/ruby/2.5.0/cache/*.gem

VOLUME ["/fluentd/etc","/fluentd/log","/var/log"]

fluent.conf

<source>
    @type tail
    path /var/log/my.log
    pos_file /var/log/td-agent/my.log4net.log.pos
    tag log4net.web
    multiline_flush_interval 10s
    #format /^\[(?<logdt>[^\]]*)\] \[(?<thread>[^ ]*)\] (?<level>[^ ]*) (?<logger>[^ ]*) - (?<message>[^*]*)?$/
    <parse>
      @type multiline
      format_firstline  /\[\d{4}-\d{1,2}-\d{1,2}/
      format1 /^\[(?<logdt>[^\]]*)\] \[(?<thread>[^ ]*)\] (?<level>[^ ]*) (?<logger>[^ ]*) - (?<message>.*)/
    </parse>
  </source>
  <filter log4net.web>
    @type grep
    <regexp>
      key level
      pattern /ERROR/
    </regexp>
  </filter>
  <filter log4net.web>
    @type adduuid
    key _uuid
  </filter>
  <match log4net.web>
    @type copy
    <store>
      @type mongo
      略...
    </store>
    <store>
      @type slack
      token xoxb-${sleck bot token}
      username fluentd-dev
      webhook_url https://hooks.slack.com/services/${hook path}
      title %s
      title_keys tag
      message %s %s
      message_keys logdt,_uuid
    </store>
  </match>
</worker>