'Why fluentd loss most of it's log while using http output plugin (in similar timestamp)

I'm now using fluentd v1.14.2 with tail source plugin and HTTP output plugin.

The log is generated in a certain format, so I wrote fluent.conf as below.

<source>
  @type prometheus
</source>

<source>
  @type prometheus_monitor
</source>

<source>
  @type prometheus_output_monitor
</source>

<source>
  @type prometheus_tail_monitor
</source>

<source>
  @type tail
  path /home1/irteam/logs/connect.log
  pos_file /fluentd/pos-logs/connect.log.pos
  tag kafka-connect.log
  <parse>
    @type multiline
    format_firstline /\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}/
    format1 /^(?<time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}) \[(?<level>[\S]+)( )*\] (?<message>.*)/
  </parse>
</source>

<filter kafka-connect.log>
  @type record_transformer
  <record>
    projectName test_name
    projectVersion 1.0.0
  </record>
</filter>

<match kafka-connect.log>
  @type http

  endpoint http://something/_store
  content_type application/json
  open_timeout 2

  <format>
    @type json
  </format>
</match>

However, when I ran the fluentd, most of the log didn't arrive at its HTTP endpoint.

For example, only one of 2022-05-16 10:28:34's data was sent (other logs on same minute discarded), so on in 2022-05-16 10:30:00.

...
// in '2022-05-16 10:28:34', only this one sent
2022-05-16 10:28:34,003 ...
...
2022-05-16 10:28:34,960 [INFO ] io.confluent.connect.hdfs.TopicPartitionWriter:377 - Starting commit and rotation for topic partition {test-topic} with start offsets {2022/05/16/10=2103190198} and end offsets {2022/05/16/10=2103390197}
2022-05-16 10:28:34,972 [INFO ] io.confluent.connect.hdfs.TopicPartitionWriter:894 - Committed hdfs://hdfs-path/request-log/{test-topic}/2022/05/16/10/{test-topic}+2+2103190198+2103390197.json for {test-topic}

// in '2022-05-16 10:30:00', only this one sent
2022-05-16 10:30:00,002 [INFO ] io.confluent.connect.hdfs.TopicPartitionWriter:377 - Starting commit and rotation for topic partition {test-topic} with start offsets {2022/05/16/10=2103310381} and end offsets {2022/05/16/10=2103340250}
2022-05-16 10:30:00,004 [INFO ] io.confluent.connect.hdfs.TopicPartitionWriter:377 - Starting commit and rotation for topic partition {test-topic} with start offsets {2022/05/16/10=2103390198} and end offsets {2022/05/16/10=2103425676}
2022-05-16 10:30:00,008 ... 
...

I believe fluentd could do better than this, so there might be some missed points.

Could anyone help to find out what's the problem with this configuration?

Any help will be really appreciated. Thanks!



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source