Initial commit: add .gitignore and README
This commit is contained in:
defiQUG
46
splunk/log4j2.xml
Normal file
46
splunk/log4j2.xml
Normal file
@@ -0,0 +1,46 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<Configuration status="WARN">
|
||||
<Properties>
|
||||
<Property name="root.log.level">${env:LOG_LEVEL:-INFO}</Property>
|
||||
<Property name="root.log.logger">${env:LOGGER:-Console}</Property>
|
||||
<Property name="host">${env:HOST:-${docker:containerId:-${hostName:-locahost}}}</Property>
|
||||
<Property name="splunk.url">${env:SPLUNK_URL}</Property>
|
||||
<Property name="splunk.token">${env:SPLUNK_TOKEN}</Property>
|
||||
<Property name="splunk.index">${env:SPLUNK_INDEX}</Property>
|
||||
<Property name="splunk.source">${env:SPLUNK_SOURCE:-besu}</Property>
|
||||
<Property name="splunk.sourcetype">${env:SPLUNK_SOURCETYPE:-besu}</Property>
|
||||
<Property name="splunk.batch_size_bytes">${env:SPLUNK_BATCH_SIZE_BYTES:-65536}</Property>
|
||||
<Property name="splunk.batch_size_count">${env:SPLUNK_BATCH_SIZE_COUNT:-1000}</Property>
|
||||
<Property name="splunk.batch_interval">${env:SPLUNK_BATCH_INTERVAL:-500}</Property>
|
||||
<Property name="splunk.disableCertificateValidation">${env:SPLUNK_SKIPTLSVERIFY:-false}</Property>
|
||||
</Properties>
|
||||
|
||||
<Appenders>
|
||||
<Routing name="Router">
|
||||
<Routes pattern="$${sys:root.log.logger}">
|
||||
<Route key="Splunk">
|
||||
<SplunkHttp name="Splunk"
|
||||
url="${sys:splunk.url}"
|
||||
token="${sys:splunk.token}"
|
||||
host="${sys:host}"
|
||||
index="${sys:splunk.index}"
|
||||
source="${sys:splunk.source}"
|
||||
sourcetype="${sys:splunk.sourcetype}"
|
||||
messageFormat="text"
|
||||
batch_size_bytes="${sys:splunk.batch_size_bytes}"
|
||||
batch_size_count="${sys:splunk.batch_size_count}"
|
||||
batch_interval="${sys:splunk.batch_interval}"
|
||||
disableCertificateValidation="${sys:splunk.disableCertificateValidation}">
|
||||
<PatternLayout pattern="%msg" />
|
||||
</SplunkHttp>
|
||||
</Route>
|
||||
</Routes>
|
||||
</Routing>
|
||||
</Appenders>
|
||||
<Loggers>
|
||||
<Logger name="org.apache.logging.log4j.status.StatusLogger" level="OFF"/>
|
||||
<Root level="${sys:root.log.level}">
|
||||
<AppenderRef ref="Router" />
|
||||
</Root>
|
||||
</Loggers>
|
||||
</Configuration>
|
||||
157
splunk/otel-collector-config.yml
Normal file
157
splunk/otel-collector-config.yml
Normal file
@@ -0,0 +1,157 @@
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
grpc:
|
||||
http:
|
||||
splunk_hec:
|
||||
hostmetrics:
|
||||
collection_interval: 10s
|
||||
scrapers:
|
||||
cpu:
|
||||
disk:
|
||||
filesystem:
|
||||
memory:
|
||||
network:
|
||||
# System load average metrics https://en.wikipedia.org/wiki/Load_(computing)
|
||||
load:
|
||||
# Paging/Swap space utilization and I/O metrics
|
||||
paging:
|
||||
# Aggregated system process count metrics
|
||||
processes:
|
||||
# System processes metrics, disabled by default
|
||||
# process:
|
||||
prometheus:
|
||||
config:
|
||||
scrape_configs:
|
||||
- job_name: 'cadvisor'
|
||||
scrape_interval: 5s
|
||||
static_configs:
|
||||
- targets: [ 'cadvisor:8080' ]
|
||||
filelog:
|
||||
include: [ /var/log/*.log, /var/log/syslog ]
|
||||
filelog/quorum:
|
||||
include: [ /var/log-quorum/*.log ]
|
||||
operators:
|
||||
- type: regex_parser
|
||||
regex: '^(?P<loglevel>\w+)\s\[(?P<timestamp_field>.*)\]\s(?P<message>.*)'
|
||||
timestamp:
|
||||
parse_from: timestamp_field
|
||||
layout_type: gotime
|
||||
layout: '01-02|15:04:05.000'
|
||||
filelog/tessera:
|
||||
include: [ /var/log-tessera/*.log ]
|
||||
|
||||
|
||||
exporters:
|
||||
splunk_hec/logs:
|
||||
# Splunk HTTP Event Collector token.
|
||||
token: '${SPLUNK_HEC_TOKEN}'
|
||||
# URL to a Splunk instance to send data to.
|
||||
endpoint: 'https://splunk:8088/services/collector'
|
||||
# Optional Splunk source: https://docs.splunk.com/Splexicon:Source
|
||||
source: 'logs'
|
||||
# Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype
|
||||
sourcetype: 'logs'
|
||||
# Splunk index, optional name of the Splunk index targeted.
|
||||
index: 'logs'
|
||||
# Maximum HTTP connections to use simultaneously when sending data. Defaults to 100.
|
||||
max_connections: 20
|
||||
# Whether to disable gzip compression over HTTP. Defaults to false.
|
||||
disable_compression: false
|
||||
# HTTP timeout when sending data. Defaults to 10s.
|
||||
timeout: 10s
|
||||
# Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS. Defaults to false.
|
||||
# For this demo, we use a self-signed certificate on the Splunk docker instance, so this flag is set to true.
|
||||
insecure_skip_verify: true
|
||||
splunk_hec/traces:
|
||||
# Splunk HTTP Event Collector token.
|
||||
token: '${SPLUNK_HEC_TOKEN}'
|
||||
# URL to a Splunk instance to send data to.
|
||||
endpoint: 'https://splunk:8088/services/collector'
|
||||
# Optional Splunk source: https://docs.splunk.com/Splexicon:Source
|
||||
source: 'besu:traces'
|
||||
# Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype
|
||||
sourcetype: 'otlp'
|
||||
# Splunk index, optional name of the Splunk index targeted.
|
||||
index: 'traces'
|
||||
# Maximum HTTP connections to use simultaneously when sending data. Defaults to 100.
|
||||
max_connections: 20
|
||||
# Whether to disable gzip compression over HTTP. Defaults to false.
|
||||
disable_compression: false
|
||||
# HTTP timeout when sending data. Defaults to 10s.
|
||||
timeout: 10s
|
||||
# Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS. Defaults to false.
|
||||
# For this demo, we use a self-signed certificate on the Splunk docker instance, so this flag is set to true.
|
||||
insecure_skip_verify: true
|
||||
splunk_hec/metrics:
|
||||
# Splunk HTTP Event Collector token.
|
||||
token: '${SPLUNK_HEC_TOKEN}'
|
||||
# URL to a Splunk instance to send data to.
|
||||
endpoint: 'https://splunk:8088/services/collector'
|
||||
# Optional Splunk source: https://docs.splunk.com/Splexicon:Source
|
||||
source: 'besu:metrics'
|
||||
# Optional Splunk source type: https://docs.splunk.com/Splexicon:Sourcetype
|
||||
sourcetype: 'prometheus'
|
||||
# Splunk index, optional name of the Splunk index targeted.
|
||||
index: 'metrics'
|
||||
# Maximum HTTP connections to use simultaneously when sending data. Defaults to 100.
|
||||
max_connections: 20
|
||||
# Whether to disable gzip compression over HTTP. Defaults to false.
|
||||
disable_compression: false
|
||||
# HTTP timeout when sending data. Defaults to 10s.
|
||||
timeout: 10s
|
||||
# Whether to skip checking the certificate of the HEC endpoint when sending data over HTTPS. Defaults to false.
|
||||
# For this demo, we use a self-signed certificate on the Splunk docker instance, so this flag is set to true.
|
||||
insecure_skip_verify: true
|
||||
|
||||
processors:
|
||||
batch:
|
||||
attributes/quorum_log_file:
|
||||
actions:
|
||||
- key: "file_name"
|
||||
pattern: ^geth-(?P<tmp_host>.*)-(?P<ip>.*)\.log
|
||||
action: extract
|
||||
- key: host.name
|
||||
from_attribute: tmp_host
|
||||
action: insert
|
||||
- key: tmp_host
|
||||
action: delete
|
||||
attributes/tessera_log_file:
|
||||
actions:
|
||||
- key: "file_name"
|
||||
pattern: ^tessera-(?P<tmp_host>.*)\.log
|
||||
action: extract
|
||||
- key: host.name
|
||||
from_attribute: tmp_host
|
||||
action: insert
|
||||
- key: tmp_host
|
||||
action: delete
|
||||
|
||||
extensions:
|
||||
health_check:
|
||||
pprof:
|
||||
zpages:
|
||||
|
||||
service:
|
||||
extensions: [pprof, zpages, health_check]
|
||||
pipelines:
|
||||
logs:
|
||||
receivers: [ splunk_hec, filelog, filelog/tessera ]
|
||||
exporters: [ splunk_hec/logs ]
|
||||
processors: [ batch ]
|
||||
logs/tessera:
|
||||
receivers: [ filelog/tessera ]
|
||||
exporters: [ splunk_hec/logs ]
|
||||
processors: [ batch, attributes/tessera_log_file ]
|
||||
logs/quorum:
|
||||
receivers: [ filelog/quorum ]
|
||||
exporters: [ splunk_hec/logs ]
|
||||
processors: [ batch, attributes/quorum_log_file ]
|
||||
traces:
|
||||
receivers: [otlp]
|
||||
exporters: [splunk_hec/traces]
|
||||
processors: [batch]
|
||||
metrics:
|
||||
receivers: [otlp, hostmetrics, prometheus]
|
||||
exporters: [splunk_hec/metrics]
|
||||
processors: [batch]
|
||||
30
splunk/splunk.yml
Normal file
30
splunk/splunk.yml
Normal file
@@ -0,0 +1,30 @@
|
||||
splunk:
|
||||
conf:
|
||||
indexes:
|
||||
directory: /opt/splunk/etc/apps/search/local
|
||||
content:
|
||||
ledger:
|
||||
coldPath: $SPLUNK_DB/ledger/colddb
|
||||
datatype: event
|
||||
homePath: $SPLUNK_DB/ledger/db
|
||||
maxTotalDataSizeMB: 4096
|
||||
thawedPath: $SPLUNK_DB/ledger/thaweddb
|
||||
logs:
|
||||
coldPath: $SPLUNK_DB/logs/colddb
|
||||
datatype: event
|
||||
homePath: $SPLUNK_DB/logs/db
|
||||
maxTotalDataSizeMB: 4096
|
||||
thawedPath: $SPLUNK_DB/logs/thaweddb
|
||||
metrics:
|
||||
coldPath: $SPLUNK_DB/metrics/colddb
|
||||
datatype: metric
|
||||
homePath: $SPLUNK_DB/metrics/db
|
||||
maxTotalDataSizeMB: 1024
|
||||
thawedPath: $SPLUNK_DB/metrics/thaweddb
|
||||
traces:
|
||||
coldPath: $SPLUNK_DB/traces/colddb
|
||||
datatype: event
|
||||
homePath: $SPLUNK_DB/traces/db
|
||||
maxTotalDataSizeMB: 1024
|
||||
thawedPath: $SPLUNK_DB/traces/thaweddb
|
||||
|
||||
Reference in New Issue
Block a user