td-agent-bit-forward.conf

[SERVICE]
    # Flush
    # =====
    # Set an interval of seconds before to flush records to a destination
    Flush        5

    # Daemon
    # ======
    # Instruct Fluent Bit to run in foreground or background mode.
    Daemon       Off

    # Log_Level
    # =========
    # Set the verbosity level of the service, values can be:
    #
    # - error
    # - warning
    # - info
    # - debug
    # - trace
    #
    # By default 'info' is set, that means it includes 'error' and 'warning'.
    Log_Level    info

    # Parsers_File
    # ============
    # Specify an optional 'Parsers' configuration file
    Parsers_File parsers.conf
    Plugins_File plugins.conf

    # HTTP Server
    # ===========
    # Enable/Disable the built-in HTTP Server for metrics
    HTTP_Server  Off
    HTTP_Listen  0.0.0.0
    HTTP_Port    2020

[INPUT]
    Name tail
    Tag oms.container.log.*
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    Interval_Sec 5
    Path /var/log/containers/*.log
    Exclude_Path *azureproxy*.log,*kube-dns*.log,*kubernetes-dashboard*.log,*heapster*.log,*addon-http-application*.log,*omsagent*.log,*tunnelfront*.log,*kube-svc*log
    DB /var/log/fblogs.db
    Parser docker 


#[OUTPUT]
#    Name  stdout
#    Match *



[FILTER]
    Name kubernetes
    Match oms.container.log.*
    #Kube_URL            https://kubernetes.default.svc.cluster.local:443
    #Merge_JSON_Log      On
    #Merge_JSON_Key      LogEntrySource
    #K8S-Logging.Parser  On

[FILTER]
    Name nest
    Match oms.container.log.*
    Operation lift
    Nested_under kubernetes 

[FILTER]
    Name record_modifier
    Match oms.container.log.*
    Whitelist_key log
    Whitelist_key stream
    Whitelist_key time
    Whitelist_key docker_id
    Whitelist_key pod_name
    Whitelist_key host

[FILTER]
    Name modify
    Match oms.container.log.*
    Rename log LogEntry
    Rename stream LogEntrySource 
    Rename time LogEntryTimeStamp
    Rename docker_id Id
    Rename pod_name Name
    Add_if_not_present SourceSystem Containers
    Rename host Computer
    

#[OUTPUT]
#    Name file
#    Match oms.container.log.*
#    Path output.txt

[OUTPUT]
    Name  forward
    Match oms.container.log.*
    Port 25225
    Host 0.0.0.0
    tls.verify Off
    tls Off
    Time_as_Integer true