Multiple index created from same plugin

[affansyed]

Hi,
this is a newbie question, but how can we configure the plugin so that we could match two different tags (or different granularity e.g. k8s.* and K8s.syslog.**?

I copy pasted the match components and only change the @id for plugin (if not it throws an error).

However, I didn't see the new index show up. Any suggestions on what is the right way of achieving this?

[affansyed]

Here is the config YAML:

<match oci.**>
         @type opensearch
         @id out_os
         @log_level info
         index_name oke-logs
         host "opensearch-cluster-master.default.svc.cluster.local"
         port "9200"
         scheme "https"
         ssl_verify "false"
         suppress_type_name true
         Retry_Limit False
         reconnect_on_error true
         reload_on_failure true
         include_timestamp true
         user admin
         password admin
</match>
<match oci.oke.syslog**>
         @type opensearch
         @log_level info
         index_name sys-logs
         host "opensearch-cluster-master.default.svc.cluster.local"
         port "9200"
         scheme "https"
         ssl_verify "false"
         suppress_type_name true
         Retry_Limit False
         reconnect_on_error true
         reload_on_failure true
         include_timestamp true
         user admin
         password admin
</match>

[cosmo0920]

This is because oci.** pattern is wider than oci.oke.syslog**.

<match oci.**>
# All of oci.** tag attached events are consumed here!!
</match>
<match oci.oke.syslog**>
# Nothing comes up.
</match>

Could you rearrange to use the narrow route pattern in the top of opensearch configuration?

<match oci.oke.syslog**>
# oci.oke.syslog** tag attached events should be consumed here.
</match>
<match oci.**>
# Not matched of oci.** tag attached events are consumed here!!
</match>

[affansyed]

Yes, thank you. Figured it out in the interim. Sorry, totally due to being a newbie on fluentd

[cosmo0920]

No worries. Everybody starts from somewhere. 💪