I try to read logs from systemd for vault.service ...
# fluent-bitd
DennyF
11/19/2025, 1:25 PMI try to read logs from systemd for vault.service .. but I'm not able to send output to Graylog / Victoria-logs. I don't see anything coming. I use something like: /insert/jsonline?_msg_field=log and Gelf_Short_Message_Key: log. Can it be, that I need to use something different?
DennyF
11/19/2025, 1:28 PMhmm, ok tested with non-tls and tcpdump .. its log. Then the issue is somewhere else.
DennyF
11/19/2025, 1:37 PMAh, no .. its message
p
Pat
11/19/2025, 1:51 PMIt's going to be impossible to help without some kind of config to look at.
I'd suggest using the stdout output as well to help you see if you are actually getting the logs in first so you know whether it is an input or output problem: https://www.fluent.do/blog/debugging-tips
d
DennyF
11/19/2025, 1:54 PMHi, I had to add prefix drop and lowercase .. and change gelf output to message and VL also to message. Then I was able to see logs.
DennyF
11/19/2025, 1:54 PMfor input tail etc. I have to use "log", but syslog and systemd requires "message"
DennyF
11/19/2025, 1:57 PMFor the records:
Copy code
- name: systemd
systemd_filter: _SYSTEMD_UNIT=vault.service
strip_underscores: on
lowercase: on
read_From_tail: on
db: /var/log/flb-storage/tail_vault.db
tag: "vault" Copy code
...
Gelf_Short_Message_Key: message
...
uri: "/insert/jsonline?_msg_field=message"p
Pat
11/19/2025, 2:54 PMyou can standardise to the same key if you want easily enough - there's filters to rename keys if they exist so you can then have a single output for them all
Pat
11/19/2025, 2:55 PMplus the tail input lets you specify the default key, if you do not then it defaults to
logmessagePat
11/19/2025, 2:56 PMparsers will also control the key names
d
DennyF
12/01/2025, 11:31 AMSounds not bad .. would maintaining a bit easier
3 Views