netdata-fluentbit.md

To visualize log files on multiple machines using Netdata and Fluent Bit, you'll need to set up a data pipeline. Here's a high-level overview of how you can achieve this:

1. Install Fluent Bit on each machine with log files
2. Configure Fluent Bit to collect and parse your log files
3. Set up Netdata on a central server or each machine
4. Configure Fluent Bit to send data to Netdata
5. Configure Netdata to receive and visualize the data from Fluent Bit

Let's break this down into more detailed steps:

1. Install Fluent Bit: Follow the official installation guide for your operating system: https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit

2. Configure Fluent Bit: Create a configuration file (usually /etc/fluent-bit/fluent-bit.conf) to collect and parse your log files. Here's a basic example:

   [INPUT]
       Name tail
       Path /path/to/your/logfile.log
       Parser your_log_parser
   
   [PARSER]
       Name your_log_parser
       Format regex
       Regex ^(?<time>[^ ]*) (?<message>.*)$
       Time_Key time
       Time_Format %Y-%m-%d %H:%M:%S
   
   [OUTPUT]
       Name http
       Match *
       Host your_netdata_host
       Port 19999
       URI /api/v1/collector/charts
       Format json_stream
   

   Adjust the Path, Parser, and Regex fields according to your log format.

3. Install Netdata: Follow the official installation guide: https://learn.netdata.cloud/docs/agent/packaging/installer

4. Configure Netdata: Enable the web_log plugin in Netdata by editing /etc/netdata/netdata.conf:

   [web_log]
       enabled = yes
   

5. Start both services:

   sudo systemctl start fluent-bit
   sudo systemctl start netdata
   

Now, Fluent Bit should be collecting your log data and sending it to Netdata, which will visualize it in real-time.

This is a basic setup. Depending on your specific needs, you might want to add more advanced configurations, such as:

• Filtering and transforming log data in Fluent Bit
• Setting up aggregation if you have multiple machines
• Configuring alerting in Netdata

Let's modify the Fluent Bit configuration to read log files from specific folders on your Windows machines. Here's how we can set this up:

1. Install Fluent Bit on Windows:
   Follow the same installation process as mentioned before.

2. Configure Fluent Bit:
   We'll adjust the configuration to use the tail input plugin for reading log files. Create or edit the fluent-bit.conf file in the Fluent Bit installation directory (usually C:\Program Files\fluent-bit\). Here's a sample configuration:

[SERVICE]
       Flush        5
       Daemon       Off
       Log_Level    info

   [INPUT]
       Name             tail
       Tag              myapp.logs
       Path             C:\Path\To\Your\Logs\*.log
       Path_Key         filename
       Exclude_Path     C:\Path\To\Your\Logs\excluded\*
       Refresh_Interval 5
       Read_from_Head   True

   [FILTER]
       Name             parser
       Match            myapp.logs
       Key_Name         log
       Parser           json
       Preserve_Key     On
       Reserve_Data     On

   [OUTPUT]
       Name             http
       Match            *
       Host             your_netdata_host
       Port             19999
       URI              /api/v1/collector/charts
       Format           json_stream

Let's break down this configuration:

• The [INPUT] section uses the tail plugin to read log files.

• Path specifies where your log files are located. Replace C:\Path\To\Your\Logs\*.log with the actual path to your log files. The *.log wildcard will match all files ending with .log.

• Path_Key adds the filename to each record.

• Exclude_Path allows you to exclude certain files or directories.

• Refresh_Interval determines how often Fluent Bit checks for new files.

• Read_from_Head tells Fluent Bit to read existing data in the files, not just new data.

• The [FILTER] section assumes your logs are in JSON format. If they're not, you'll need to adjust this or remove it.

• The [OUTPUT] section sends data to Netdata. Replace your_netdata_host with the actual hostname or IP address of your Netdata server.

3. Start Fluent Bit as a Windows service:
   Open a command prompt as administrator and run:

   sc create fluent-bit binPath= "C:\Program Files\fluent-bit\bin\fluent-bit.exe -c C:\Program Files\fluent-bit\fluent-bit.conf"
   sc start fluent-bit
   

4. Netdata Configuration:
   Ensure your Netdata instance is set up to receive data from Fluent Bit. If you're using Docker on Windows, your Netdata configuration should include:

   [web_log]
       enabled = yes

   You may need to add this to your netdata.conf file and restart the Netdata container.

5. Firewall Configuration:
   Ensure that your Windows Firewall allows Fluent Bit to send data to your Netdata instance. You may need to add an outbound rule for the Fluent Bit executable.

This setup will collect log files from the specified folders on your Windows machines and send them to Netdata for visualization.

Some additional tips:

1. If your log files are not in JSON format, you'll need to create a custom parser in the Fluent Bit configuration.
2. For multiple log file types, you can create multiple [INPUT] sections with different tags.
3. You may want to add additional [FILTER] sections to process or enrich your log data before sending it to Netdata.

@meetc-icpl & @sakirm-icpl look into this