使用vector采集StarRocks的审计日志

data_dir = "/var/lib/vector"

[api]
enabled = true
address = "0.0.0.0:8686"

[sources.fe_audit_log]
type = "file"
include = [ "/opt/StarRocks-2.5/fe/log/fe.audit.log"]
glob_minimum_cooldown_ms = 10000  # 日志文件发现的间隔 10s 
#fingerprinting.strategy = "device_and_inode"   # 推荐，用于准确跟踪文件
ignore_older = 86400000  # 1 day
max_line_bytes = 10240000   # 单行记录超过1020KB则丢弃
read_from = "beginning"   # 可选择 beginning 和 end

[sinks.es_cluster]
inputs = [ "fe_audit_log" ]
type = "elasticsearch"
endpoints = ["http://172.19.31.244:9200"]

  [sinks.es_cluster.batch]
  "batch.max_events" = 1000
  "batch.timeout_secs" = 2

  [sinks.es_cluster.buffer]
  type = "disk"
  max_size = 536870976
  when_full = "block"

  [sinks.es_cluster.bulk]
  index = "starrocks-auditlog-%Y.%m"

./bin/vector -c config/main.toml -c config/fe_audit_log.toml 

cp etc/systemd/vector.service /usr/lib/systemd/system/vector.service 
chmod +x /usr/lib/systemd/system/vector.service

systemctl start vector.service
systemctl status vector.service
systemctl enable vector.service