A log router collects log records from system and application sources, optionally processes or prunes them, and forwards them to a central destination for search and analysis. Log forwarding, collection, and aggregation are treated as closely related operational roles. section 4.1 section 2.3.3
Typical inputs and selection concerns include:
- System logs from operating systems, Kubernetes control planes and worker nodes, user activity, API usage, and infrastructure automation. section 4.1
- Application logs emitted by code; standardizing agents where possible reduces patching and upgrade work. section 4.1
- Runtime footprint, ingestion throughput, delivery reliability, encryption, multitenancy, and ingestion cost shape agent selection. section 2.3.3
- Sampling or filtering, such as dropping production DEBUG records, can reduce downstream volume and storage costs. section 2.3.3
Containerized routing pipeline
A Docker Compose setup sends ho11y container logs through Fluentd to Fluent Bit, which forwards them to OpenSearch; OpenSearch Dashboards then supports querying and visualization. Fluentd offers a larger plugin ecosystem, while lightweight Fluent Bit suits constrained environments. section 4.1.1
Listing 4.4 Fluent Bit configuration
[INPUT]
Name forward #1
Listen 0.0.0.0 #2
Port 24224 #3
[OUTPUT]
Name opensearch #4
Match ** #5
Host opensearch-node1 #6
Port 9200
Index ho11y #7
Suppress_Type_Name on #8
The configuration shows the router accepting Forward input and matching records to an OpenSearch output. section 4.1.1
