fluentd.conf

# Do not collect fluentd's own logs to avoid infinite loops.
<match fluent.**>
  @type null
</match>

<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>




<source>
  @type tail

   format none
   rotate_wait 60s
   #path /mnt/logs/%Y/%m/%d/*.log
   path "#{ENV['APPS_LOGS_LOG_PATTERN']}"

   pos_file /mnt/buffers/mysql_slow_log.pos
   read_from_head true
   tag mysql.slowlog.db

   format /(?:[^ ]*)? (?<server>[^ ]*)?\s+(?:[^ ]*:)?(\s*)(?<message>.+)$/

</source>


<match mysql.slowlog.* >
  @type mysqlslowquerylog
  add_tag_prefix cocatenated.
</match>

<filter **.*>
  @type record_modifier
  <record>
    timestampFormated ${Time.at(record['timestamp'].to_s.slice(0,10).to_i, record['timestamp'].to_s.slice(0,10).to_i%1000).strftime('%Y-%m-%dT%H:%M:%S.%LZ')}
  </record>
</filter>

<match *.**>
  @type copy
 <store>
   @id   forward_es
   @type elasticsearch
   hosts "#{ENV['ELS_HOST']}"
   user "#{ENV['ELS_USER']}"
   password "#{ENV['ELS_PWD']}"
   reload_on_failure true
   ssl_version TLSv1_2
   scheme https
   time_key timestampFormated 
   logstash_format true
   logstash_prefix mysqlSlowQueries
   request_timeout 15s
   logstash_dateformat %Y%m%d
   include_tag_key true
   tag_key @log_name
   ssl_verify false
   type_name _doc

 <buffer>
     flush_mode interval
     @type file
     path  /mnt/buffers/es-buffer/mysqlSlowQueries.*.buffer
     flush_thread_count "#{ENV['FLUSH_THREAD_COUNT']}"
     flush_interval 5s
     chunk_limit_size 1M
     overflow_action block
     total_limit_size 4G
     queued_chunks_limit_size 1000
   </buffer>
</store>
#<store>
#@type stdout
#</store>
</match>
~