---
title: Fluentd
description: Send logs to Coralogix with Fluentd using the HTTP output plugin, with configuration examples for single and multiple log sources.
url: https://coralogix.com/docs/integrations/files/fluentd/
product: ingress
feature: Logs Ingress
feature_id: logs.ingress
feature_identifier: ingress/logs.ingress
last_updated: '2026-10-29'
---

# Fluentd

Warning

**Security advisory**: On October 20, 2026, the private keys for 8 intermediate certificate authorities operated by eMudhra were reported compromised. This is an industry-wide issue, not specific to Coralogix. Pull the updated `coralogixrepo/coralogix-fluentd-multiarch:v1.18.0-4` image (or `coralogixrepo/fluentd-coralogix-ecs:v1.18.0-4` on ECS) and restart. Force a re-pull if you already run one of these tags, since a cached image won't be replaced. Coralogix endpoints and internal services do not use eMudhra or emSign certificates, and we have not identified any impact to customer data.

See the [eMudhra security advisory](https://coralogix.com/blog/coralogix-security-advisory-emudhra-certificate-update/) for full upgrade guidance and breaking-change details.

If you have any questions or need help upgrading, our Support team is here to help. Reach out through in-app chat and mention "Security advisory eMudhra" and the required component.

Coralogix provides seamless integration with Fluentd so you can send your logs from anywhere and parse them according to your needs.

## Prerequisites

* Fluentd [installed](https://docs.fluentd.org/installation)

## Parameters

Every configuration requires that you supply your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) (`Api_Key`). Choose the <!-- -->https\://ingress./logs/v1/singles<!-- --> endpoint that corresponds to your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md) using the domain selector at the top of the page.

## Configuration

The following section provides a number of configuration examples.

### Generic Configuration

The example below collects all log files from the /var/log/ path, using the generic HTTP output plugin. We **recommend** this plugin due to its adjustability and exposed metrics. Other collection options can be found [here](https://docs.fluentd.org/input).

```
<system>

	log_level info

</system>



<source>

	@type tail

	@id tail_var_logs

	@label @CORALOGIX

	path /var/log/*.log

	pos_file /var/log/fluent/all.pos

        path_key path

	tag all

	read_from_head true

	<parse>

		@type none

	</parse>

</source>



<label @CORALOGIX>

	<filter **>

	@type record_transformer

	@log_level warn

	enable_ruby true

	auto_typecast true

	renew_record true

	<record>

		applicationName "Example_App"

		subsystemName "Example_Subsystem"

		text ${record.to_json}

	</record>

	</filter>



<match **>

	@type http

	@id http_to_coralogix

	endpoint "https://ingress.eu2.coralogix.com/logs/v1/singles"

	headers {"authorization":"Bearer <Api_Key>"}

	retryable_response_codes 408, 500, 502, 503, 504, 507

	error_response_as_unrecoverable false

	<buffer>

		@type memory

		chunk_limit_size 5MB

		compress gzip

		flush_interval 1s

		retry_max_times 5

		retry_type periodic

		retry_wait 2

	</buffer>

	<secondary>

		#If any messages fail to send they will be send to STDOUT for debug.

		@type stdout

	</secondary>

</match>

</label>
```

### Configuration for Multiple Sources

The example below provides a Fluentd configuration that has several log file sources and a unique [subsystem name](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md) for each source. It uses the "tag" option to specify a unique value in each source and a "tag" variable as subsystem. The result is several different tags depending on the source of the log.

```
<system>

  log_level info

</system>



<source>

  @type tail

  @id tail_path_1

  @label @CORALOGIX

  path /<path number 1>/*/*.log

  pos_file /<path number 1>/all.pos

        path_key path

  tag path_number_1

  read_from_head true

  <parse>

    @type none

  </parse>

</source>



<source>

  @type tail

  @id tail_path_2

  @label @CORALOGIX

  path /<path number 2>/*/*.log

  pos_file /<path number 2>/all.pos

        path_key path

  tag path_number_2

  read_from_head true

  <parse>

    @type none

  </parse>

</source>



<label @CORALOGIX>

  <filter **>

  @type record_transformer

  @log_level warn

  enable_ruby true

  auto_typecast true

  renew_record true

  <record>

    applicationName "<Application Name Here>"

    subsystemName ${tag}

    text ${record.to_json}

  </record>

  </filter>



<match **>

  @type http

  @id http_to_coralogix

  endpoint "https://ingress.eu2.coralogix.com/logs/v1/singles"

  headers {"authorization":"Bearer <Api_Key>"}

  retryable_response_codes 408, 500, 502, 503, 504, 507

  error_response_as_unrecoverable false

  <buffer>

    @type memory

    chunk_limit_size 5MB

    compress gzip

    flush_interval 1s

    retry_max_times 5

    retry_type periodic

    retry_wait 2

  </buffer>

  <secondary>

    #If any messages fail to send they will be send to STDOUT for debug.

    @type stdout

  </secondary>

</match>

</label>
```

## Additional resources

|                     |                                                                                       |
| ------------------- | ------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://coralogix.com/docs/integrations/coralogix-endpoints.md) |