Audit prerequisites

You first have to add the HTTP input plugin to the fluent.conf file to retrieve records from HTTP POST

• Add HTTP plugin to Fluentd

  <source>
    @type http
    port 8888
    bind 0.0.0.0
    body_size_limit 32m
    keepalive_timeout 10s
    # tag is part of the URL, e.g.,
    # curl -X POST -d 'json={"action":"login","user":2}' http://localhost:8888/tag.here
  </source>

• An API binding secret k5-auditlog-settings needs to be created in the namespace with this service URL

• The path in the above URL is used to create the tag for the log event and can be used to filter logs

You also need to add the plugin to fluentd.conf for transferring logs data to elasticsearch

• Add ElasticSearch plugin to Fluentd

  <match tag.here>
    @type elasticsearch
    logstash_format true
    host <hostname> #(optional; default="localhost")
    port <port> #(optional; default=9200)
    index_name <index name> #(optional; default=fluentd)
    type_name <type name> #(optional; default=fluentd)
  </match>

Add the above plugin in fluent.conf to enable fluentd to send all logs with tag tag.here to the elasticsearch instance configured.