From 84265b1f014d8376c9c2a20208a3e5d548f7436e Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:19:25 +0100 Subject: [PATCH 1/4] Updated to include new input plugin doc for Windows System Statistics. Applies to #2139. Signed-off-by: Eric D. Schabell --- SUMMARY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SUMMARY.md b/SUMMARY.md index 12245f3ba..fe8ecb414 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -125,6 +125,7 @@ * [Windows Event logs (winlog)](pipeline/inputs/windows-event-log.md) * [Windows Event logs (winevtlog)](pipeline/inputs/windows-event-log-winevtlog.md) * [Windows exporter metrics](pipeline/inputs/windows-exporter-metrics.md) + * [Windows System Statistics (winstat)](pipeline/inputs/windows-system-statistics.md) * [Parsers](pipeline/parsers.md) * [Configuring parsers](pipeline/parsers/configuring-parser.md) * [Decoders](pipeline/parsers/decoders.md) From 8b9641dec0b3d64aa6d3faf9d80564a96331d824 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:20:15 +0100 Subject: [PATCH 2/4] Updated to include new input plugin doc for Windows System Statistics. Applies to #2139. Signed-off-by: Eric D. Schabell --- pipeline/inputs/windows-system-statistics.md | 99 ++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 pipeline/inputs/windows-system-statistics.md diff --git a/pipeline/inputs/windows-system-statistics.md b/pipeline/inputs/windows-system-statistics.md new file mode 100644 index 000000000..8a5344ee2 --- /dev/null +++ b/pipeline/inputs/windows-system-statistics.md @@ -0,0 +1,99 @@ +# Windows System Statistics (winstat) + +The _Windows System Statistics_ (`winstat`) input plugin collects system-level statistics from Windows environments, including CPU usage, memory consumption, disk I/O, and network activity. This plugin uses Windows Performance Counters to gather real-time system metrics. + +{% hint style="info" %} + +This plugin is only available on Windows operating systems and requires appropriate permissions to access Windows Performance Counters. + +{% endhint %} + +## Configuration parameters + +The plugin supports the following configuration parameters: + +| Key | Description | Default | +|:----------------|:--------------------------------------------------------------------------------------------------------|:--------| +| `Interval_Sec` | Polling interval in seconds. | `1` | +| `Interval_NSec` | Polling interval in nanoseconds. | `0` | +| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | + +## Metrics collected + +The `winstat` plugin collects the following system statistics: + +| Metric Category | Description | +|:----------------|:----------------------------------------------------------------------------| +| CPU | CPU usage percentage, including user and system time | +| Memory | Memory usage including total, available, and used memory | +| Disk | Disk I/O statistics including read/write operations and throughput | +| Network | Network interface statistics including bytes sent/received and packet counts | + +## Get started + +To collect Windows system statistics, you can run the plugin from the command line or through the configuration file: + +### Command line + +You can run the plugin from the command line: + +```shell +fluent-bit -i winstat -o stdout +``` + +Which returns information similar to the following: + +```text +... +[0] winstat: [1699123456.123456789, {"cpu.usage"=>15.3, "cpu.user"=>10.2, "cpu.system"=>5.1, "memory.total"=>8192, "memory.available"=>4096, "memory.used"=>4096, "disk.read_bytes"=>1024000, "disk.write_bytes"=>512000, "network.bytes_sent"=>2048000, "network.bytes_recv"=>1024000}] +[1] winstat: [1699123457.123456789, {"cpu.usage"=>16.1, "cpu.user"=>11.0, "cpu.system"=>5.1, "memory.total"=>8192, "memory.available"=>4080, "memory.used"=>4112, "disk.read_bytes"=>1025000, "disk.write_bytes"=>515000, "network.bytes_sent"=>2050000, "network.bytes_recv"=>1025000}] +... +``` + +### Configuration file + +In your main configuration file append the following: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + +```yaml +pipeline: + inputs: + - name: winstat + tag: winstat + interval_sec: 1 + interval_nsec: 0 + + outputs: + - name: stdout + match: '*' +``` + +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text +[INPUT] + Name winstat + Tag winstat + Interval_Sec 1 + Interval_NSec 0 + +[OUTPUT] + Name stdout + Match * +``` + +{% endtab %} +{% endtabs %} + +Total interval (sec) = `Interval_Sec` + (`Interval_NSec` / 1000000000) + +For example: `1.5s` = `1s` + `500000000ns` + +## Notes + +- The `winstat` plugin requires Windows Performance Counters access. Ensure Fluent Bit is running with appropriate permissions. +- This plugin is Windows-only and will not work on Linux, macOS, or other operating systems. +- For Prometheus-based metrics collection on Windows, consider using the [Windows Exporter Metrics](windows-exporter-metrics.md) input plugin instead. From 2bdfa9a414523e8b9e71df7c719f3fa71d838189 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Mon, 24 Nov 2025 12:27:37 +0100 Subject: [PATCH 3/4] Lint fix for winstat input plugin doc fix. Signed-off-by: Eric D. Schabell --- pipeline/inputs/windows-system-statistics.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pipeline/inputs/windows-system-statistics.md b/pipeline/inputs/windows-system-statistics.md index 8a5344ee2..963bf5c58 100644 --- a/pipeline/inputs/windows-system-statistics.md +++ b/pipeline/inputs/windows-system-statistics.md @@ -1,4 +1,4 @@ -# Windows System Statistics (winstat) +# Windows system statistics (winstat) The _Windows System Statistics_ (`winstat`) input plugin collects system-level statistics from Windows environments, including CPU usage, memory consumption, disk I/O, and network activity. This plugin uses Windows Performance Counters to gather real-time system metrics. @@ -95,5 +95,5 @@ For example: `1.5s` = `1s` + `500000000ns` ## Notes - The `winstat` plugin requires Windows Performance Counters access. Ensure Fluent Bit is running with appropriate permissions. -- This plugin is Windows-only and will not work on Linux, macOS, or other operating systems. +- This plugin is Windows-only and won't work on Linux, macOS, or other operating systems. - For Prometheus-based metrics collection on Windows, consider using the [Windows Exporter Metrics](windows-exporter-metrics.md) input plugin instead. From 95885eac3591b69f506490b38ab1019c5d033c74 Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Tue, 25 Nov 2025 12:38:29 +0100 Subject: [PATCH 4/4] Fixes for new documentation of Blob input plugin configuration options and updated code examples. Signed-off-by: Eric D. Schabell --- pipeline/inputs/blob.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/pipeline/inputs/blob.md b/pipeline/inputs/blob.md index c29bd991c..a370c2cf4 100644 --- a/pipeline/inputs/blob.md +++ b/pipeline/inputs/blob.md @@ -23,12 +23,12 @@ The plugin supports the following configuration parameters: | `threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). When enabled, the plugin runs in a separate thread, which can improve performance for I/O-bound operations. | `false` | | `threaded.ring_buffer.capacity` | Set custom ring buffer capacity when the input runs in threaded mode. This determines how many records can be buffered in the ring buffer before blocking. | `1024` | | `threaded.ring_buffer.window` | Set custom ring buffer window percentage for threaded inputs. This controls when the ring buffer is considered "full" and triggers backpressure handling. | `5` | -| `upload_success_action` | Action to perform on the file after successful processing. Supported values: `delete` (delete the file), `move` (move the file), `none` (no action). When set to `move`, use `upload_success_suffix` to specify the destination. | _none_ | -| `upload_success_suffix` | Suffix to append to the filename when moving a file after successful processing. Only used when `upload_success_action` is set to `move`. For example, if set to `.processed`, a file named `data.bin` will be moved to `data.bin.processed`. | _none_ | -| `upload_success_message` | Custom message to include in the log when a file is successfully processed. This can be used for debugging or monitoring purposes. | _none_ | -| `upload_failure_action` | Action to perform on the file after processing failure. Supported values: `delete` (delete the file), `move` (move the file), `none` (no action). When set to `move`, use `upload_failure_suffix` to specify the destination. | _none_ | -| `upload_failure_suffix` | Suffix to append to the filename when moving a file after processing failure. Only used when `upload_failure_action` is set to `move`. For example, if set to `.failed`, a file named `data.bin` will be moved to `data.bin.failed` if processing fails. | _none_ | -| `upload_failure_message` | Custom message to include in the log when file processing fails. This can be used for debugging or monitoring purposes. | _none_ | +| `upload_success_action` | Action to perform on the file after successful upload. Supported values: `delete` (delete the file), `add_suffix` (rename file by appending a suffix), `emit_log` (emit a log record with a custom message). When set to `add_suffix`, use `upload_success_suffix` to specify the suffix. When set to `emit_log`, use `upload_success_message` to specify the message. | _none_ | +| `upload_success_suffix` | Suffix to append to the filename after successful upload. Only used when `upload_success_action` is set to `add_suffix`. For example, if set to `.processed`, a file named `data.bin` will be renamed to `data.bin.processed`. | _none_ | +| `upload_success_message` | Message to emit as a log record after successful upload. Only used when `upload_success_action` is set to `emit_log`. This can be used for debugging or monitoring purposes. | _none_ | +| `upload_failure_action` | Action to perform on the file after upload failure. Supported values: `delete` (delete the file), `add_suffix` (rename file by appending a suffix), `emit_log` (emit a log record with a custom message). When set to `add_suffix`, use `upload_failure_suffix` to specify the suffix. When set to `emit_log`, use `upload_failure_message` to specify the message. | _none_ | +| `upload_failure_suffix` | Suffix to append to the filename after upload failure. Only used when `upload_failure_action` is set to `add_suffix`. For example, if set to `.failed`, a file named `data.bin` will be renamed to `data.bin.failed`. | _none_ | +| `upload_failure_message` | Message to emit as a log record after upload failure. Only used when `upload_failure_action` is set to `emit_log`. This can be used for debugging or monitoring purposes. | _none_ | ## How it works @@ -206,9 +206,9 @@ pipeline: {% endtab %} {% endtabs %} -### Configuration with file actions after processing +### Configuration with file actions after upload -This example moves files after successful processing and handles failures: +This example renames files after successful upload and handles failures: {% tabs %} {% tab title="fluent-bit.yaml" %} @@ -219,9 +219,9 @@ pipeline: - name: blob path: /var/log/binaries/*.bin database_file: /var/lib/fluent-bit/blob.db - upload_success_action: move + upload_success_action: add_suffix upload_success_suffix: .processed - upload_failure_action: move + upload_failure_action: add_suffix upload_failure_suffix: .failed tag: blob.data @@ -238,9 +238,9 @@ pipeline: Name blob Path /var/log/binaries/*.bin Database_File /var/lib/fluent-bit/blob.db - Upload_Success_Action move + Upload_Success_Action add_suffix Upload_Success_Suffix .processed - Upload_Failure_Action move + Upload_Failure_Action add_suffix Upload_Failure_Suffix .failed Tag blob.data