How to Send Logs to Multiple Outputs With Same Match Tags in Fluentd?

Better Stack Team
Updated on February 1, 2024

To direct logs matching a specific tag to multiple outputs in Fluentd, the @type copy directive can be utilized. Here's an example configuration:

/etc/fluent/fluentd.conf

  <match pattern>
    @type copy
    <store>
      @type file
      path /var/log/myapp1
      ...
    </store>
    <store>
      ...
    </store>
    <store>
      ...
    </store>
  </match>
</label>

The copy plugin in Fluentd is designed to duplicate log events and send them to multiple destinations. The <store> section within the <match> block is where you define and configure the storage output for each duplicated log entry.

Suppose you have a source generating logs:

/etc/fluent/fluentd.conf
<source>
  @type dummy
  dummy '{"timestamp":"2024-01-27T08:33:17","severity":"ERROR"}'
  format json
  tag mylogs
</source>

To send these logs to both a file and standard output, you can configure it as follows:

/etc/fluent/fluentd.conf
  ...
  <match mylogs>
    @type copy
    <store>
      @type file
      path /var/log/mytestapp
      format json
    </store>
    <store>
      @type stdout
    </store>
  </match>
</label>

When running Fluentd, you will see the logs in the console:

 
2024-01-28 19:26:29 +0000 [info]: #0 fluentd worker is now running worker=0
2024-01-28 19:26:30.071500553 +0000 mylogs: {"timestamp":"2024-01-27T08:33:17","severity":"ERROR"}

Simultaneously, a /var/log/mytestapp directory will be created, containing two files:

Output
buffer.<b6100691ab4b1f59fcafccef634b0b085>.log  buffer.b6100691ab4b1f59fcafccef634b0b085.log.meta

Viewing the file ending with .log will display the log contents:

/var/log/mytestapp/buffer..log
{"timestamp":"2024-01-27T08:33:17","severity":"ERROR"}

🔭 Want to centralize and monitor your logs?

Go to Logtail and start your log management in 5 minutes. [/summary]

Better Uptime Dashboard