Skip to content

Adding YAML examples to developers wasm filter plugin docs. Fixes #1768. #1769

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 24, 2025
+60 −3
Merged

Adding YAML examples to developers wasm filter plugin docs. Fixes #1768. #1769

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e908ae
Adding YAML examples to developers wasm filter plugin docs. Fixes ##1…
eschabell Jun 20, 2025
5082eb7
Added comment for accessable_path and running Fluent Bit from the was…
eschabell Jun 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 60 additions & 3 deletions development/wasm-filter-plugins.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,32 @@ pub extern "C" fn rust_filter(tag: *const c_char, tag_len: u32, time_sec: u32, t

The `//export XXX` attribute on TinyGo and `#[no_mangle]` attribute on Rust are required. This is because TinyGo and Rust will mangle their function names if they aren't specified.

Once built, a Wasm program will be available. Then you can execute that built program with the following Fluent Bit configuration:
Once built, a Wasm program will be available. Then you can execute that built program with one of the following Fluent Bit configurations:

{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
pipeline:
inputs:
- name: dummy
tag: dummy.local

filters:
- name: wasm
match: 'dummy.*'
wasm_path: /path/to/built_filter.wasm
function_name: super_awesome_filter
# Note: run Fluent Bit from the 'wasm_path' location.
accessible_paths: /path/to/fluent-bit

outputs:
- name: stdout
match: '*'
```

{% endtab %}
{% tab title="fluent-bit.conf" %}

```text
[INPUT]
Expand All @@ -110,13 +135,16 @@ Once built, a Wasm program will be available. Then you can execute that built pr
Match dummy.*
WASM_Path /path/to/built_filter.wasm
Function_Name super_awesome_filter
accessible_paths .,/path/to/fluent-bit
accessible_paths /path/to/fluent-bit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just checking this change, is the original one a comma separated list with . allowing you to be path agnostic @cosmo0920 or is it just a typo?

Copy link
Contributor

@cosmo0920 cosmo0920 Jun 20, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It isn't typo. Just including for the current working directory.
However, this should be removed if we pursue the rigid permission list approach.
Sometimes, I put Wasm programs into /path/to/fluent-bit/build directory and run fluent-bit in /path/to/fluent-bit/build directory. So, if we remove the magic . period symbol, we need to write the actual path of the place that contains the actual Wasm programs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add that info to the docs then I think, at least call it out in the example here

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, so I will add some text to refer to the fact that fluent bit needs to run from the same directory as the '/path/to/built_filter.wasm' file (aka the 'wasm_path').


[OUTPUT]
Name stdout
Match *
```

{% endtab %}
{% endtabs %}

For example, one of the sample [Rust Wasm filters](https://github.com/fluent/fluent-bit/tree/master/examples/filter_rust) should generate its filtered logs as follows:

```text
Expand All @@ -125,8 +153,34 @@ For example, one of the sample [Rust Wasm filters](https://github.com/fluent/flu
[0] dummy.local: [1666270590.271107000, {"lang"=>"Rust", "message"=>"dummy", "original"=>"{"message":"dummy"}", "tag"=>"dummy.local", "time"=>"2022-10-20T12:56:30.271107000 +0000"}]
```
Another example of a Rust Wasm filter is the [flb_filter_iis](https://github.com/kenriortega/flb_filter_iis) filter.

This filter takes the [Internet Information Services (IIS)](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis) [w3c logs](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis#select-w3c-fields-to-log) (with some custom modifications) and transforms the raw string into a standard Fluent Bit JSON structured record.

{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
pipeline:
inputs:
- name: dummy
dummy: '{"log": "2023-08-11 19:56:44 W3SVC1 WIN-PC1 ::1 GET / - 80 ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/115.0.0.0+Safari/537.36+Edg/115.0.1901.200 - - localhost 304 142 756 1078 -"}'
tag: 'iis.*'

filters:
- name: wasm
match: 'iis.*'
wasm_path: /plugins/flb_filter_iis_wasm.wasm
function_name: flb_filter_log_iis_w3c_custom
accessible_paths: .

outputs:
- name: stdout
match: 'iis.*'
```

{% endtab %}
{% tab title="fluent-bit.conf" %}

```text
[INPUT]
Name dummy
Expand All @@ -145,6 +199,9 @@ This filter takes the [Internet Information Services (IIS)](https://learn.micros
match iis.*
```

{% endtab %}
{% endtabs %}

The incoming raw strings from an IIS log are composed of the following fields:

`date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-bytes cs-bytes time-taken c-authorization-header`
Expand Down Expand Up @@ -199,4 +256,4 @@ AOT compiling should generate CPU architecture-dependent objects. If you want to

* [C filter](https://github.com/fluent/fluent-bit/tree/master/examples/filter_wasm_c)
* [Rust Filter](https://github.com/fluent/fluent-bit/tree/master/examples/filter_rust)
* [TinyGo filter](https://github.com/fluent/fluent-bit/tree/master/examples/filter_wasm_go)
* [TinyGo filter](https://github.com/fluent/fluent-bit/tree/master/examples/filter_wasm_go)