Feature Request: add Fluentbit Splunk Example

[colinbjohnson]

It would be nice to have a fluentbit Splunk example.

[PettitWesley]

I agree... basically we need to take this and turn it into a firelens example: https://github.com/splunk/fluent-plugin-splunk-hec

I could do it myself, though ideally someone from Splunk would do it and help test/validate.

[LeonardoDG2084]

Hi,
I have the spunk as output from my awsfirelens, and this is my actual configuration, I hope this help you! If you want I can submit a PR with complete example, (In my scenario I`m using terraform to create task_definition file and fluent-bit.conf)

...........

   "logConfiguration": {
        "logDriver": "awsfirelens",
        "secretOptions": null,
        "options": {
          "Splunk_Send_Raw": "On",
          "Splunk_token": "YourTokenHere",
          "Port": "8088",
          "Host": "hec.yout.url.",
          "Name": "splunk"

...........

     "firelensConfiguration": {
        "type": "fluentbit",
        "options": {
          "config-file-type": "s3",
          "config-file-value": "arn:aws:s3:::customer-success-prod/ecs-cluster/service/mib-gateway/fluent-bit.conf"
        }
      },

...........

fluent-bit.conf file (the awsfirelens solution change the file name fluent-bit.conf from S3 and include as external.conf)

[FILTER]
    Name nest
    Match *
    Operation nest
    Wildcard *
    Nest_under event

[FILTER]
    Name      modify
    Match     *
    Add sourcetype <AddYourSourceType>
    Add index <AddYourIndex>

[PettitWesley]

If you want I can submit a PR with complete example

@LeonardoDG2084 Please do! That would be awesome!