Fluentd

Open in ChatGPTOpen in Claude

Warning

Security advisory: On October 20, 2026, the private keys for 8 intermediate certificate authorities operated by eMudhra were reported compromised. This is an industry-wide issue, not specific to Coralogix. Pull the updated coralogixrepo/coralogix-fluentd-multiarch:v1.18.0-4 image (or coralogixrepo/fluentd-coralogix-ecs:v1.18.0-4 on ECS) and restart. Force a re-pull if you already run one of these tags, since a cached image won't be replaced. Coralogix endpoints and internal services do not use eMudhra or emSign certificates, and we have not identified any impact to customer data.

See the eMudhra security advisory for full upgrade guidance and breaking-change details.

If you have any questions or need help upgrading, our Support team is here to help. Reach out through in-app chat and mention "Security advisory eMudhra" and the required component.

Coralogix provides seamless integration with Fluentd so you can send your logs from anywhere and parse them according to your needs.

Prerequisites

• Fluentd installed

Parameters

Every configuration requires that you supply your Coralogix Send-Your-Data API key (Api_Key). Choose the https://ingress./logs/v1/singles endpoint that corresponds to your Coralogix domain using the domain selector at the top of the page.

Configuration

The following section provides a number of configuration examples.

Generic Configuration

The example below collects all log files from the /var/log/ path, using the generic HTTP output plugin. We recommend this plugin due to its adjustability and exposed metrics. Other collection options can be found here.

<system>
	log_level info
</system>

<source>
	@type tail
	@id tail_var_logs
	@label @CORALOGIX
	path /var/log/*.log
	pos_file /var/log/fluent/all.pos
        path_key path
	tag all
	read_from_head true
	<parse>
		@type none
	</parse>
</source>

<label @CORALOGIX>
	<filter **>
	@type record_transformer
	@log_level warn
	enable_ruby true
	auto_typecast true
	renew_record true
	<record>
		applicationName "Example_App"
		subsystemName "Example_Subsystem"
		text ${record.to_json}
	</record>
	</filter>

<match **>
	@type http
	@id http_to_coralogix
	endpoint "https://ingress.eu2.coralogix.com/logs/v1/singles"
	headers {"authorization":"Bearer <Api_Key>"}
	retryable_response_codes 408, 500, 502, 503, 504, 507
	error_response_as_unrecoverable false
	<buffer>
		@type memory
		chunk_limit_size 5MB
		compress gzip
		flush_interval 1s
		retry_max_times 5
		retry_type periodic
		retry_wait 2
	</buffer>
	<secondary>
		#If any messages fail to send they will be send to STDOUT for debug.
		@type stdout
	</secondary>
</match>
</label>

Configuration for Multiple Sources

The example below provides a Fluentd configuration that has several log file sources and a unique subsystem name for each source. It uses the "tag" option to specify a unique value in each source and a "tag" variable as subsystem. The result is several different tags depending on the source of the log.

<system>
  log_level info
</system>

<source>
  @type tail
  @id tail_path_1
  @label @CORALOGIX
  path /<path number 1>/*/*.log
  pos_file /<path number 1>/all.pos
        path_key path
  tag path_number_1
  read_from_head true
  <parse>
    @type none
  </parse>
</source>

<source>
  @type tail
  @id tail_path_2
  @label @CORALOGIX
  path /<path number 2>/*/*.log
  pos_file /<path number 2>/all.pos
        path_key path
  tag path_number_2
  read_from_head true
  <parse>
    @type none
  </parse>
</source>

<label @CORALOGIX>
  <filter **>
  @type record_transformer
  @log_level warn
  enable_ruby true
  auto_typecast true
  renew_record true
  <record>
    applicationName "<Application Name Here>"
    subsystemName ${tag}
    text ${record.to_json}
  </record>
  </filter>

<match **>
  @type http
  @id http_to_coralogix
  endpoint "https://ingress.eu2.coralogix.com/logs/v1/singles"
  headers {"authorization":"Bearer <Api_Key>"}
  retryable_response_codes 408, 500, 502, 503, 504, 507
  error_response_as_unrecoverable false
  <buffer>
    @type memory
    chunk_limit_size 5MB
    compress gzip
    flush_interval 1s
    retry_max_times 5
    retry_type periodic
    retry_wait 2
  </buffer>
  <secondary>
    #If any messages fail to send they will be send to STDOUT for debug.
    @type stdout
  </secondary>
</match>
</label>

Additional resources

Coralogix Endpoints	Coralogix Endpoints