Logging v2: Buffer config applied to SplunkHEC results in error 'cannot handle arguments for <buffer ...> section'

Follow
Table of Contents

Issue

The SplunkHEC plugin currently rejects any buffer config defined in an Output or ClusterOutput with the error:
[error]: config error file="/fluentd/etc/generated.conf" error_class=Fluent::ConfigError error="this plugin 'Fluent::Plugin::SplunkHecOutput' cannot handle arguments for <buffer ...> section"

Pre-requisites

  • Rancher v2.5.x with Logging V2 installed from the Cluster Explorer > Apps & Marketplace interface
  • SplunkHEC configured as an Output, or a ClusterOutput along with a buffer defined.

Resolution

This is a known bug, which means you have to define an empty tags list in your buffer config:

spec:
  splunkHec:
    hec_host: splunkhec.example.com
    hec_port: 8443
    hec_token:
      valueFrom:
        secretKeyRef:
         key: token
         name: splunkhec-token
    host: splunkhec.example.com:8443
    index: k8s-test
    insecure_ssl: true
    protocol: https
    sourcetype: K8S
    buffer:
      type: memory
      total_limit_size: 8G
      flush_mode: interval
      flush_interval: 10s
      tags: "[]"
    status:
      active: true  

Further reading

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.