Log filtering keeps logging useful without storing everything. An application can emit verbose records, while Fluentd selectively retains, routes, or suppresses them before storage. section 19.4
Use tags and match rules to tune collection without restarting application containers:
- Configure Fluentd match blocks to inspect tags supplied by the Docker logging driver. section 19.4
- Route verbose access-log records to Fluentd container stdout instead of Elasticsearch. section 19.4
- Enrich records by splitting tags into application, service, and image fields for easier Kibana filtering. section 19.4
- Change the Fluentd configuration independently, allowing logging-level adjustments without application downtime. section 19.4
Filter access logs
With a tag prefix of gallery.access-log, the first match block sends access-log entries to stdout. Other gallery records continue to Elasticsearch, so Kibana shows application logs but no newly filtered access logs. section 19.4
Listing 19.4 Sending log entries to different targets based on the tag
<match gallery.access-log.**>
@type copy
<store>
@type stdout
</store>
</match>
<match gallery.**>
@type copy
<store>
@type elasticsearch
. . .
Inspect the Fluentd match configuration that sends tagged access logs to stdout and other gallery logs to Elasticsearch. section 19.4
