[error]: Permission denied - /var/log/httpd/access_log

# vi /etc/init.d/td-agent

DAEMON_ARGS=${DAEMON_ARGS---user td-agent}
TD_AGENT_ARGS="${TD_AGENT_ARGS-/usr/sbin/td-agent --group td-agent --log /var/log/td-agent/td-agent.log}"

改成

DAEMON_ARGS=${DAEMON_ARGS---user root}
TD_AGENT_ARGS="${TD_AGENT_ARGS-/usr/sbin/td-agent --user root --group td-agent --log /var/log/td-agent/td-agent.log}"

References :
職場でよく耳にするfluentdを試してみました - Qiita

td-agent debug log

# cat /var/log/td-agent/td-agent.log

References :

職場でよく耳にするfluentdを試してみました - Qiita

Fluentd regexp example and Fluentular

References :
tail Input Plugin | Fluentd
Fluentular: a Fluentd regular expression editor

Fluentd 區分不同主機來源 Fluentd add hostname in data

1.
Use tag name
Collecting Logs into Elasticsearch and S3 | Fluentd

<source>
  type tail
  format apache
  path /var/log/httpd/access_log
  pos_file /var/log/td-agent/httpd.access.pos
  tag hostname.httpd.access
</source>

<match *.*>

  type elasticsearch
  host localhost
  port 9200
  include_tag_key true
  tag_key @log_name
  logstash_format true
  flush_interval 10s

</match>

2.
fukata/fluent-plugin-hostname

<source>
    type syslog
    port 5140
    bind 0.0.0.0
    format /^(?[^ ]* [^ ]* [^ ]*) (?[^ ]*) (?[a-zA-Z0-9_\/\.\-]*)(?:\[(?[0-9]+)\])?[^\:]*\: *(?.*)$/
    time_format %b %d %H:%M:%S
    tag system.local

</source>

<match system.**>
  type hostname
  key_name @source_host
  add_prefix es
</match>

<match es.system.**>
  type elasticsearch
  logstash_format true
  host 192.168.1.253
  port 9200
  index_name fluentd
  type_name syslog
  flush_interval 1s
  include_tag_key true
  tag_key @log_name</match>

3.
repeatedly/fluent-plugin-record-modifier

Fluentd error="Unknown output plugin 'geoip'.

# gem install fluent-plugin-geoip

fluentd 手動安裝

# wget http://packages.treasure-data.com/debian/pool/contrib/t/td-agent/td-agent_1.1.18.orig.tar.gz
# tar zxf td-agent_1.1.18.orig.tar.gz
# cd td-agent-1.1.18

# git clone https://github.com/fluent/fluentd.git
# cd fluentd

# apt-get update
# apt-get install ruby ruby1.9.1-dev
# gem install yajl-ruby msgpack cool.io http_parser
# gem install fluent-plugin-elasticsearch fluent-plugin-hostname

# vi fluent.conf
# ./bin/fluentd -c fluent.conf -vv &




References :
Installing Fluentd from Source | Fluentd