update fluent-bit

fluent-bit/README.md

@@ -11,6 +11,7 @@ $ mkdir -p data/{etc,var}
 $ wget -P data/etc https://github.com/fluent/fluent-bit/raw/master/conf/fluent-bit.conf \
                    https://github.com/fluent/fluent-bit/raw/master/conf/parsers.conf \
                    https://github.com/fluent/fluent-bit/raw/master/conf/plugins.conf
+$ vim data/etc/fluent-bit.conf
 $ docker-compose up -d
 $ docker-compose logs --tail 10 -f
 ```

fluent-bit/data/etc/parsers.conf

@@ -38,6 +38,10 @@
     Time_Key time
     Time_Format %d/%b/%Y:%H:%M:%S %z
 
+[PARSER]
+    Name   logfmt
+    Format logfmt
+
 [PARSER]
     Name         docker
     Format       json
@@ -124,3 +128,11 @@
     Name    kube-custom
     Format  regex
     Regex   (?<tag>[^.]+)?\.?(?<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$
+
+[PARSER]
+    # Examples: TCP: https://rubular.com/r/Q8YY6fHqlqwGI0  UDP: https://rubular.com/r/B0ID69H9FvN0tp
+    Name    kmsg-netfilter-log
+    Format  regex
+    Regex   ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) kernel - - - \[[0-9\.]*\] (?<logprefix>[^ ]*)\s?IN=(?<in>[^ ]*) OUT=(?<out>[^ ]*) MAC=(?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<ethtype>[0-9a-f]{2}:[0-9a-f]{2}) SRC=(?<saddr>[^ ]*) DST=(?<daddr>[^ ]*) LEN=(?<len>[^ ]*) TOS=(?<tos>[^ ]*) PREC=(?<prec>[^ ]*) TTL=(?<ttl>[^ ]*) ID=(?<id>[^ ]*) (D*F*)\s*PROTO=(?<proto>[^ ]*)\s?((SPT=)?(?<sport>[0-9]*))\s?((DPT=)?(?<dport>[0-9]*))\s?((LEN=)?(?<protolen>[0-9]*))\s?((WINDOW=)?(?<window>[0-9]*))\s?((RES=)?(?<res>0?x?[0-9]*))\s?(?<flag>[^ ]*)\s?((URGP=)?(?<urgp>[0-9]*))
+    Time_Key  time
+    Time_Format  %Y-%m-%dT%H:%M:%S.%L%z

fluent-bit/docker-compose.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   fluent-bit:
-    image: fluent/fluent-bit:2.1
+    image: fluent/fluent-bit:3.2
     ports:
       - "2020:2020"
     volumes: