Multiple Files Tailed and Processed in Parallel? about fluentd-kubernetes-sumologic

[frankreno]

relates to #45.

[andrews32]

I just experienced this in recent weeks. I don't think #44 relates to #45. #45 seems to be about SumoLogic throttling the customers account and only allowing a percentage of the traffic to enter as long as it keeps the account quota under the cap. This is is more an Accounting/Finance issue than a application issue.

#44 one is about fluentd using the in_tail plugin to tail multiple logs in parallel. In further reading, it seems that is just how in_tail works.

The problem was in /var/log/containers/*.log we had say 10 different logs but only 1 fluentd running. The fluentd would get stuck on the first high volume log and never read the other 9 logs. Once traffic slowed and fluentd got to the end of the first log, fluentd would go to the next log. The problem was by the time fluentd go to logs 2-10 they already rotated and that data was lost.

I ended up running 10 fluentd daemonsets, each dedicated to the 10 different application logs. Feel free to close out #44 now.