From 626feac3bdea0f2e893e4b2e82294462df67a134 Mon Sep 17 00:00:00 2001
From: "zhangkun9038@dingtalk.com" <zhangkun9038@dingtalk.com>
Date: Mon, 24 Mar 2025 22:35:32 +0800
Subject: [PATCH] =?UTF-8?q?fluentd=20=E5=86=B7=E7=83=AD=E7=A8=8B=E5=BA=A6?=
 =?UTF-8?q?=E8=BF=87=E6=BB=A4=E5=99=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 efk_cluster/fluentd-configMap.yaml | 85 ++++++++++++++++++++++--------
 1 file changed, 64 insertions(+), 21 deletions(-)

diff --git a/efk_cluster/fluentd-configMap.yaml b/efk_cluster/fluentd-configMap.yaml
index 0226110..f9f4dac 100644
--- a/efk_cluster/fluentd-configMap.yaml
+++ b/efk_cluster/fluentd-configMap.yaml
@@ -15,27 +15,70 @@ data:
 
     <label @main>
       <match sardine.log.**>
-        @type copy
-        <store>
-          @type elasticsearch
-          @id output_elasticsearch
-          host elasticsearch
-          port 9200
-          scheme http
-          user fluentd_user
-          password fluentd_password
-          logstash_format true
-          logstash_prefix logstash
-          logstash_dateformat %Y.%m.%d
-          flush_interval 5s  # 缩短批量写入间隔
-          @log_level debug
-          id_key _id
-          remove_keys _id
-        </store>
-        <store>
-          @type stdout
-          @id output_stdout
-        </store>
+        @type rewrite_tag_filter
+        <rule>
+          key @timestamp
+          pattern /^(202[4-9]|2[1-9]\d{3})/
+          tag hot.${tag}
+        </rule>
+        <rule>
+          key @timestamp
+          pattern /^(202[0-3])/
+          tag warm.${tag}
+        </rule>
+        <rule>
+          key @timestamp
+          pattern /^(201\d|200\d|19\d{2})/
+          tag cold.${tag}
+        </rule>
+      </match>
+
+      <match hot.sardine.log.**>
+        @type elasticsearch
+        @id output_elasticsearch_hot
+        hosts elasticsearch-0.elasticsearch-service.efk.svc.cluster.local:9200
+        scheme http
+        user fluentd_user
+        password fluentd_password
+        logstash_format true
+        logstash_prefix logstash
+        index_date_pattern now/d
+        include_tag_key true
+        tag_key @log_name
+        flush_interval 5s
+        @log_level debug
+      </match>
+
+      <match warm.sardine.log.**>
+        @type elasticsearch
+        @id output_elasticsearch_warm
+        hosts elasticsearch-1.elasticsearch-service.efk.svc.cluster.local:9200
+        scheme http
+        user fluentd_user
+        password fluentd_password
+        logstash_format true
+        logstash_prefix logstash
+        index_date_pattern now/d
+        include_tag_key true
+        tag_key @log_name
+        flush_interval 10s
+        @log_level debug
+      </match>
+
+      <match cold.sardine.log.**>
+        @type elasticsearch
+        @id output_elasticsearch_cold
+        hosts elasticsearch-2.elasticsearch-service.efk.svc.cluster.local:9200
+        scheme http
+        user fluentd_user
+        password fluentd_password
+        logstash_format true
+        logstash_prefix logstash
+        index_date_pattern now/d
+        include_tag_key true
+        tag_key @log_name
+        flush_interval 30s
+        @log_level debug
       </match>
     </label>