ArvanCloud CloudLogs

Send logs to ArvanCloud CloudLogs

Supported event types: logs

The ArvanCloud CloudLogs output plugin sends log records to the ArvanCloud CloudLogs ingestion API over HTTPS.

Fluent Bit posts a JSON body to the fixed endpoint https://napi.arvancloud.ir/logging/v1/entries/write. Each Fluent Bit record is wrapped in the CloudLogs entry schema. Authentication uses an API key sent in the Authorization header as apikey <value>.

This plugin is available in Fluent Bit version 5.1.3 and greater. It's included in official builds. If you compile Fluent Bit from source, the FLB_OUT_ARVANCLOUD_CLOUDLOGS build option is enabled by default.

Configuration parameters

Key	Description	Default
apikey	Required. API key used for authorization. Fluent Bit sends it as Authorization: apikey <value>.	none
gzip	Enable gzip compression of the HTTP request body. If compression fails, Fluent Bit sends the uncompressed payload.	false
include_tag_key	When enabled, include the original Fluent Bit tag as an extra field on each CloudLogs entry.	false
log_type	Static logType value used when log_type_key isn't set, or when the record field referenced by log_type_key is missing or empty.	fluentbit
log_type_key	Optional record accessor that selects a field from the record to use as logType. When the field exists and isn't empty, it takes priority over log_type.	none
tag_key	Field name used for the Fluent Bit tag when include_tag_key is enabled.	tag
timestamp_key	Optional record accessor that selects a record field to forward as the CloudLogs timestamp. The value is sent as-is. If the key is unset, or the field is missing or empty, Fluent Bit uses the event timestamp formatted as UTC RFC3339 with microseconds.	none

The destination host (napi.arvancloud.ir), port (443), URI (/logging/v1/entries/write), and HTTPS scheme are fixed by the plugin. Host, port, and URI aren't configurable.

Request payload

Fluent Bit builds one JSON object per flush:

{
  "logs": [
    {
      "logType": "fluentbit",
      "timestamp": "2024-01-15T10:30:45.000000Z",
      "severity": "INFO",
      "resource": {
        "type": "general"
      },
      "payload": {
        "key": "value"
      }
    }
  ]
}

Behavior notes:

• payload contains the original record map unchanged.

• severity is always set to INFO.

• resource is always set to {"type":"general"}.

• When include_tag_key is enabled, the tag is added as a sibling field of payload using tag_key.

• logType resolution order is log_type_key (when present and non-empty), then log_type.

• Timestamp resolution:

  1. If timestamp_key is set and the field exists and isn't empty, forward the field value as-is.

  2. Otherwise, use the Fluent Bit event timestamp formatted as UTC RFC3339 with microseconds (for example 2024-01-15T10:30:45.000000Z).

To parse a timestamp string into event time, use a parser.

HTTP response handling

Status	Result
200-205	Success (FLB_OK)
400, 401, 403	Failure without retry (FLB_ERROR)
429	Retry (FLB_RETRY)
500 or greater	Retry (FLB_RETRY)
Other HTTP client errors	Failure without retry (FLB_ERROR)
Connection or transport failure	Retry (FLB_RETRY)

Get started

Minimal configuration

apikey is the only required option:

fluent-bit.yaml

pipeline:
  inputs:
    - name: dummy
      tag: app.logs

  outputs:
    - name: arvancloud_cloudlogs
      match: '*'
      apikey: YOUR_API_KEY_HERE

fluent-bit.conf

[INPUT]
  Name  dummy
  Tag   app.logs

[OUTPUT]
  Name    arvancloud_cloudlogs
  Match   *
  Apikey  YOUR_API_KEY_HERE

Full configuration example

fluent-bit.yaml

pipeline:
  inputs:
    - name: dummy
      tag: app.logs
      dummy: '{"message":"hello","category":"security","ts":"2024-01-15T10:30:45.123456+01:00"}'

  outputs:
    - name: arvancloud_cloudlogs
      match: '*'
      apikey: YOUR_API_KEY_HERE
      log_type: myapp
      log_type_key: $category
      timestamp_key: $ts
      gzip: true
      include_tag_key: true
      tag_key: fluentbit_tag

fluent-bit.conf

[INPUT]
  Name   dummy
  Tag    app.logs
  Dummy  {"message":"hello","category":"security","ts":"2024-01-15T10:30:45.123456+01:00"}

[OUTPUT]
  Name              arvancloud_cloudlogs
  Match             *
  Apikey            YOUR_API_KEY_HERE
  Log_Type          myapp
  Log_Type_Key      $category
  Timestamp_Key     $ts
  Gzip              true
  Include_Tag_Key   true
  Tag_Key           fluentbit_tag

With that example, Fluent Bit derives logType from $category (security), forwards $ts as the CloudLogs timestamp, compresses the request body with gzip when possible, and includes the tag under fluentbit_tag.

References

• ArvanCloud CloudLogs