ProxmoxVE Logs, Banzai Cloud Logging Operator, Elasticsearch

This article assumes that you already have a working Banzai Cloud Logging Operator. Documentation.

Expose fluentd with ingress-nginx

ingress-nginx: Exposing TCP and UDP services
Based on service created by banzai cloud logging operator
values.yaml:

          - name: tcp.24240
            value: "logging/logging-fluentd:tcp-fluentd"
          - name: controller.service.ports.fluentd
            value: "24240"
          - name: controller.service.targetPorts.fluentd
            value: "tcp-fluentd"

Install fluentd on ProxmoxVE node

https://docs.fluentd.org/installation/install-by-deb

• curl -fsSL https://toolbelt.treasuredata.com/sh/install-debian-buster-td-agent4.sh | sh

Configure fluentd

Edit /etc/td-agent/td-agent.conf

• To pull from rsyslog:

<source>
  @type syslog
  port 5140
  bind 0.0.0.0
  tag system
</source>

• forward docs, adjust host and port:

<match **>
  @type forward
  <server>
    name k1cp0
    host 192.168.100.250
    port 31156
    weight 60
  </server>
  <server>
    name k1w0
    host 192.168.100.248
    port 31156
    weight 60
  </server>
</match>

• systemctl restart td-agent

Configure rsyslog 

Edit /etc/rsyslog.conf:

# Send log messages to Fluentd
*.* @127.0.0.1:5140

• systemctl restart rsyslog

Confirm things are working