From 84265b1f014d8376c9c2a20208a3e5d548f7436e Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:19:25 +0100 Subject: [PATCH 1/6] Updated to include new input plugin doc for Windows System Statistics. Applies to #2139. Signed-off-by: Eric D. Schabell --- SUMMARY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SUMMARY.md b/SUMMARY.md index 12245f3ba..fe8ecb414 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -125,6 +125,7 @@ * [Windows Event logs (winlog)](pipeline/inputs/windows-event-log.md) * [Windows Event logs (winevtlog)](pipeline/inputs/windows-event-log-winevtlog.md) * [Windows exporter metrics](pipeline/inputs/windows-exporter-metrics.md) + * [Windows System Statistics (winstat)](pipeline/inputs/windows-system-statistics.md) * [Parsers](pipeline/parsers.md) * [Configuring parsers](pipeline/parsers/configuring-parser.md) * [Decoders](pipeline/parsers/decoders.md) From 8b9641dec0b3d64aa6d3faf9d80564a96331d824 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:20:15 +0100 Subject: [PATCH 2/6] Updated to include new input plugin doc for Windows System Statistics. Applies to #2139. Signed-off-by: Eric D. Schabell --- pipeline/inputs/windows-system-statistics.md | 99 ++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 pipeline/inputs/windows-system-statistics.md diff --git a/pipeline/inputs/windows-system-statistics.md b/pipeline/inputs/windows-system-statistics.md new file mode 100644 index 000000000..8a5344ee2 --- /dev/null +++ b/pipeline/inputs/windows-system-statistics.md @@ -0,0 +1,99 @@ +# Windows System Statistics (winstat) + +The _Windows System Statistics_ (`winstat`) input plugin collects system-level statistics from Windows environments, including CPU usage, memory consumption, disk I/O, and network activity. This plugin uses Windows Performance Counters to gather real-time system metrics. + +{% hint style="info" %} + +This plugin is only available on Windows operating systems and requires appropriate permissions to access Windows Performance Counters. + +{% endhint %} + +## Configuration parameters + +The plugin supports the following configuration parameters: + +| Key | Description | Default | +|:----------------|:--------------------------------------------------------------------------------------------------------|:--------| +| `Interval_Sec` | Polling interval in seconds. | `1` | +| `Interval_NSec` | Polling interval in nanoseconds. | `0` | +| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | + +## Metrics collected + +The `winstat` plugin collects the following system statistics: + +| Metric Category | Description | +|:----------------|:----------------------------------------------------------------------------| +| CPU | CPU usage percentage, including user and system time | +| Memory | Memory usage including total, available, and used memory | +| Disk | Disk I/O statistics including read/write operations and throughput | +| Network | Network interface statistics including bytes sent/received and packet counts | + +## Get started + +To collect Windows system statistics, you can run the plugin from the command line or through the configuration file: + +### Command line + +You can run the plugin from the command line: + +```shell +fluent-bit -i winstat -o stdout +``` + +Which returns information similar to the following: + +```text +... +[0] winstat: [1699123456.123456789, {"cpu.usage"=>15.3, "cpu.user"=>10.2, "cpu.system"=>5.1, "memory.total"=>8192, "memory.available"=>4096, "memory.used"=>4096, "disk.read_bytes"=>1024000, "disk.write_bytes"=>512000, "network.bytes_sent"=>2048000, "network.bytes_recv"=>1024000}] +[1] winstat: [1699123457.123456789, {"cpu.usage"=>16.1, "cpu.user"=>11.0, "cpu.system"=>5.1, "memory.total"=>8192, "memory.available"=>4080, "memory.used"=>4112, "disk.read_bytes"=>1025000, "disk.write_bytes"=>515000, "network.bytes_sent"=>2050000, "network.bytes_recv"=>1025000}] +... +``` + +### Configuration file + +In your main configuration file append the following: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: winstat + tag: winstat + interval_sec: 1 + interval_nsec: 0 + + outputs: + - name: stdout + match: '*' +``` + +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text +[INPUT] + Name winstat + Tag winstat + Interval_Sec 1 + Interval_NSec 0 + +[OUTPUT] + Name stdout + Match * +``` + +{% endtab %} +{% endtabs %} + +Total interval (sec) = `Interval_Sec` + (`Interval_NSec` / 1000000000) + +For example: `1.5s` = `1s` + `500000000ns` + +## Notes + +- The `winstat` plugin requires Windows Performance Counters access. Ensure Fluent Bit is running with appropriate permissions. +- This plugin is Windows-only and will not work on Linux, macOS, or other operating systems. +- For Prometheus-based metrics collection on Windows, consider using the [Windows Exporter Metrics](windows-exporter-metrics.md) input plugin instead. From 2bdfa9a414523e8b9e71df7c719f3fa71d838189 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:27:37 +0100 Subject: [PATCH 3/6] Lint fix for winstat input plugin doc fix. Signed-off-by: Eric D. Schabell --- pipeline/inputs/windows-system-statistics.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pipeline/inputs/windows-system-statistics.md b/pipeline/inputs/windows-system-statistics.md index 8a5344ee2..963bf5c58 100644 --- a/pipeline/inputs/windows-system-statistics.md +++ b/pipeline/inputs/windows-system-statistics.md @@ -1,4 +1,4 @@ -# Windows System Statistics (winstat) +# Windows system statistics (winstat) The _Windows System Statistics_ (`winstat`) input plugin collects system-level statistics from Windows environments, including CPU usage, memory consumption, disk I/O, and network activity. This plugin uses Windows Performance Counters to gather real-time system metrics. @@ -95,5 +95,5 @@ For example: `1.5s` = `1s` + `500000000ns` ## Notes - The `winstat` plugin requires Windows Performance Counters access. Ensure Fluent Bit is running with appropriate permissions. -- This plugin is Windows-only and will not work on Linux, macOS, or other operating systems. +- This plugin is Windows-only and won't work on Linux, macOS, or other operating systems. - For Prometheus-based metrics collection on Windows, consider using the [Windows Exporter Metrics](windows-exporter-metrics.md) input plugin instead. From 9f752bbd2ca0ae17a6177e07c4173ebedbf399bd Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 15:57:46 +0100 Subject: [PATCH 4/6] Adding UDP output plugin doc. Applies to #2144. Signed-off-by: Eric D. Schabell --- pipeline/outputs/udp.md | 205 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 205 insertions(+) create mode 100644 pipeline/outputs/udp.md diff --git a/pipeline/outputs/udp.md b/pipeline/outputs/udp.md new file mode 100644 index 000000000..2b5be0096 --- /dev/null +++ b/pipeline/outputs/udp.md @@ -0,0 +1,205 @@ +--- +description: Send logs to a remote UDP server +--- + +# UDP + +The _UDP_ output plugin lets you send records to a remote UDP server. The payload can be formatted in different ways as required. + +## Configuration parameters + +This plugin supports the following parameters: + +| Key | Description | Default | +|:--- |:----------- |:------- | +| `Host` | Target host where the UDP server is listening. | `127.0.0.1` | +| `Port` | `UDP` Port of the target service. | `5170` | +| `Format` | Specify the data format to be printed. Supported formats: `msgpack`, `json`, `json_lines`, `json_stream`. | `json_lines` | +| `json_date_key` | Specify the name of the time key in the output record. To disable the time key, set the value to `false`. | `date` | +| `json_date_format` | Specify the format of the date. Supported formats: `double`, `epoch`, `epoch_ms`, `iso8601`, `java_sql_timestamp`. | `double` | +| `raw_message_key` | Use a raw message key for the message. When set, the plugin sends the value of this key as the raw message instead of formatting it as JSON. | _none_ | +| `workers` | The number of [workers](../../administration/multithreading.md#outputs) to perform flush operations for this output. | `2` | + +## Get started + +To send records to a `UDP` server, you can run the plugin from the command line or through the configuration file. + +### Command line + +The `UDP` plugin can read the parameters from the command line through the `-p` argument (property) or by setting them directly through the service URI. The URI format is the following: + +```text +udp://host:port +``` + +Using the format specified, start Fluent Bit through: + +```shell +fluent-bit -i cpu -t cpu -o udp://192.168.2.3:5170 -p format=json_lines -v +``` + +which is similar to: + +```shell +fluent-bit -i cpu -t cpu -o udp -p Host=192.168.2.3 -p Port=5170 \ + -p Format=json_lines -o stdout -m '*' +``` + +### Configuration file + +In your main configuration file append the following: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: cpu + tag: cpu + + outputs: + - name: udp + match: '*' + host: 192.168.2.3 + port: 5170 + format: json_lines +``` + +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text +[INPUT] + Name cpu + Tag cpu + +[OUTPUT] + Name udp + Match * + Host 192.168.2.3 + Port 5170 + Format json_lines +``` + +{% endtab %} +{% endtabs %} + +## JSON format examples + +### JSON lines format + +This example sends CPU metrics in JSON lines format to a `UDP` server: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: cpu + tag: cpu + + outputs: + - name: udp + match: '*' + host: 127.0.0.1 + port: 5170 + format: json_lines + json_date_key: timestamp + json_date_format: iso8601 +``` + +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text +[INPUT] + Name cpu + Tag cpu + +[OUTPUT] + Name udp + Match * + Host 127.0.0.1 + Port 5170 + Format json_lines + Json_date_key timestamp + Json_date_format iso8601 +``` + +{% endtab %} +{% endtabs %} + +Run the following in a separate terminal, `netcat` will start listening for messages on `UDP` port `5170`: + +```shell +nc -u -l 5170 +``` + +After Fluent Bit connects, you should see output in JSON format: + +```text +{"timestamp":"2024-01-15T10:30:45.123456Z","cpu_p":1.1875,"user_p":0.5625,"system_p":0.625} +{"timestamp":"2024-01-15T10:30:46.123456Z","cpu_p":2.25,"user_p":2.0,"system_p":0.25} +``` + +### Raw message format + +When `raw_message_key` is set, the plugin sends the value of the specified key as a raw message instead of formatting it as JSON. This is for when you want to send pre-formatted messages: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: tail + path: /var/log/app.log + tag: app + + outputs: + - name: udp + match: '*' + host: 127.0.0.1 + port: 5170 + raw_message_key: message +``` + +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text +[INPUT] + Name tail + Path /var/log/app.log + Tag app + +[OUTPUT] + Name udp + Match * + Host 127.0.0.1 + Port 5170 + Raw_message_key message +``` + +{% endtab %} +{% endtabs %} + +## Message size limitations + +`UDP` has a maximum datagram size of 65535 bytes. If a record exceeds this size, the plugin will send it but log a debug message. For large messages, consider using `TCP` or `HTTP` output plugins instead. + +## Testing + +To test the `UDP` output plugin, you can use `netcat` to listen for incoming `UDP` messages: + +```shell +nc -u -l 5170 +``` + +Or use `socat` for more advanced testing: + +```shell +socat UDP-RECV:5170 STDOUT +``` From bce57f13655feb75775de08abff72d0396c0beea Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 15:58:26 +0100 Subject: [PATCH 5/6] Adding UDP output plugin doc to SUMMARY listing. Applies to #2144. Signed-off-by: Eric D. Schabell --- SUMMARY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SUMMARY.md b/SUMMARY.md index 53d543d06..9011c5331 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -216,6 +216,7 @@ * [Standard output](pipeline/outputs/standard-output.md) * [Syslog](pipeline/outputs/syslog.md) * [TCP and TLS](pipeline/outputs/tcp-and-tls.md) + * [UDP](pipeline/outputs/udp.md) * [Treasure Data](pipeline/outputs/treasure-data.md) * [Vivo Exporter](pipeline/outputs/vivo-exporter.md) * [WebSocket](pipeline/outputs/websocket.md) From 1102bc145679e0ef9c11c2cf4da732be96bbf0b7 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 16:03:34 +0100 Subject: [PATCH 6/6] Lint fixes for udp output plugin doc fix. Signed-off-by: Eric D. Schabell --- pipeline/outputs/udp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipeline/outputs/udp.md b/pipeline/outputs/udp.md index 2b5be0096..b3c70a89e 100644 --- a/pipeline/outputs/udp.md +++ b/pipeline/outputs/udp.md @@ -188,7 +188,7 @@ pipeline: ## Message size limitations -`UDP` has a maximum datagram size of 65535 bytes. If a record exceeds this size, the plugin will send it but log a debug message. For large messages, consider using `TCP` or `HTTP` output plugins instead. +`UDP` has a maximum datagram size of `65535` bytes. If a record exceeds this size, the plugin will send it but log a debug message. For large messages, consider using `TCP` or `HTTP` output plugins instead. ## Testing