I configure my fluentD configuration and for certain events, I need to push them to both the log and elasticsearch log. I use the copy plugin for this, but I see a significant difference in the time sent by calling fluentD to return - the time spent on the test POST call made through the postman. It will take about 5 seconds if I use elasticsearch matching inside copy vs <1s to directly match elasticsearch. I am using the following configuration.
<match testapp.elastic> @type elasticsearch host localhost port 9200 index_name fluentdtest type_name fluentdtest </match> #Common match for loggly and mongo <match logapp.**> type copy <store> @type elasticsearch host localhost port 9200 index_name fluentdtest type_name fluentdtest </store> <store> type forest subtype loggly <template> loggly_url ##myurl##/tag/${tag} </template> </store> </match>
plugins elasticsearch fluentd
labyrinth
source share