From dff5cc67fcadc0d442fb5bf7de7d11e23f4f4e89 Mon Sep 17 00:00:00 2001
From: Nicolas MURE <nicolas.mure@knplabs.com>
Date: Fri, 7 Feb 2020 19:18:06 +0100
Subject: [PATCH] add fluentd config example to ingest imaginary logs (#260)

* add fluentd config example to ingest imaginary logs

* fixup! add fluentd config example to ingest imaginary logs
---
 README.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/README.md b/README.md
index f5eec18..865c610 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,8 @@ To get started, take a look the [installation](#installation) steps, [usage](#co
   - [Form data](#form-data)
   - [Params](#params)
   - [Endpoints](#get-)
+- [Logging](#logging)
+  - [Fluentd log ingestion](#fluentd-log-ingestion)
 - [Authors](#authors)
 - [License](#license)
 
@@ -1168,6 +1170,60 @@ Accepts: `image/*, multipart/form-data`. Content-Type: `image/*`
 - interlace `bool`
 - aspectratio `string`
 
+## Logging
+
+Imaginary uses an [apache compatible log format](/log.go).
+
+### Fluentd log ingestion
+
+You can ingest Imaginary logs with fluentd using the following fluentd config :
+
+```
+# use your own tag name (*.imaginary for this example)
+<filter *.imaginary>
+    @type parser
+    key_name log
+    reserve_data true
+
+    <parse>
+        @type multi_format
+        # access logs parser
+        <pattern>
+            format regexp
+            expression /^[^ ]* [^ ]* [^ ]* \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*) (?<response_time>[^ ]*)$/
+            types code:integer,size:integer,response_time:float
+            time_key time
+            time_format %d/%b/%Y %H:%M:%S
+        </pattern>
+        # warnings / error logs parser
+        <pattern>
+            format none
+            message_key message
+        </pattern>
+    </parse>
+</filter>
+
+<match *.imaginary>
+    @type rewrite_tag_filter
+
+    # Logs with code field are access logs, and logs without are error logs
+    <rule>
+        key code
+        pattern ^.+$
+        tag ${tag}.access
+    </rule>
+    <rule>
+        key code
+        pattern ^.+$
+        invert true
+        tag ${tag}.error
+    </rule>
+</match>
+```
+
+In the end, access records are tagged with `*.imaginary.access`, and warning /
+error records are tagged with `*.imaginary.error`.
+
 ## Support
 
 ### Backers