Unable to collect logs from Windows Server using Fluent-bit

Products

• VCF Operations

Issue/Introduction

Upon following the official documentation, Set up the Windows system to collect logs in VCF Operations, the Fluent-bit service is installed and runs on the default conf file. However, when we redo the conf file as mentioned in the article, we are not able to start the Fluent-bit service.

The following error occurs:

Start-Service: Service 'fluent-bit' cannot be started due to the following error : Cannot start service fluent-bit on computer '.'. 
At line:1 char:1

Environment

VCF Operations 9.1

Cause

The first line of the example configuration file shown in the documentation is incorrect and the example shown has indentation issues in the code.

Resolution

• Create a new fluent-bit conf file after removing the incorrect 'Ini, TOML' line in the config file as per above documentation, The documentation will be updated in future.
• Use the example configuration file attached to this KB which has correct indentation i.e. visible vertical alignment of the columns in key and value fields
• Replace the value of Log_management_FQDN from your environment. This can be found under Build->Lifecycle->Components page

Note: The directories mentioned in Log_file, DB, tls.ca_file fileds needs to be created before hand for the respective files to be auto generated in them.

[SERVICE]
    Flush        5
    Daemon       Off
    Log_Level    info
    Log_File     C:\Program Files\fluent-bit\conf\logs\fluent-bit.log

[INPUT]
    Name          winevtlog 
    Channels      Application,System,Security
    Interval_Sec  1
    DB            C:\Program Files\fluent-bit\db\winevtlog.db

[FILTER]
    Name    modify
    Match   *
    Rename  Message text
    Add     appname v-windows
    Add     hostname ${HOSTNAME}

[OUTPUT]
    Name          http
    Match         *
    Host          <Log_management_FQDN>
    Port          9543
    URI           /api/v2/events
    Format        json
    Json_date_key timestamp
    Json_date_format epoch_ms
    Header        Content-Type application/json
    tls           On
    tls.verify    On
    tls.ca_file   C:\Program Files\fluent-bit\cert\ca-root.crt