Support Windows container FluentBit querying Windows event logs

[inosvaruag]

Is your feature request related to a problem? Please describe.
FluentBit currently only runs as a service or local process. It cannot be used as a container on Windows and get the underlying VM's logs.

Describe the solution you'd like
Allow FluentBit to accept credentials and login to the underlying host for getting access to logs - event logs, files, etc. WMI Remoting, Powershell remoting, CIM sessions, etc. could be used for establishing this connection.

Describe alternatives you've considered
There is no way of running FluentBit to get underlying VM's logs.

[fujimotos]

FluentBit currently only runs as a service or local process. It cannot be used as a container on Windows and get the underlying VM's logs.

@inosvaruag This is already (partly) possible.

The common solution is to map the log directory of the host machine
to the guest containers. For example, if you're running a k8s container
on Windows host, you can add the following in deployment.yaml:

volumes:
- name: k            # /k/ for kubelet.err.log
  hostPath: 
    path: /k/
- name: varlog       # /var/log/ for conteiner logs
  hostPath:
    path: /var/log/
- name: progdata     # You need this to resolve symlinks in /var/log
  hostPath:
    path: /ProgramData/

With this configuration, the guest can see the host log (e.g.
C:\k\kubelet.err.log), and can easily transfer the data.

The Event Log part is not possible as of now, and indeed a bit tricky.
Since the guest might not have relevant DLLs to reconstruct an
event record, it is not well positioned for that task.

We can have more detailed discussion if you can share your
background situation and requirement.

[inosvaruag]

@fujimotos - yes I'm aware that FluentBit can be used to fetch file logs by mounting a container.

This feature request is more about adding event log support for containerized FluentBit

[inosvaruag]

I've opened an identical request on FluentD's eventlog plugin - fluent/fluent-plugin-windows-eventlog#65.

It would be great to see similar support in FluentBit.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.

[canob]

This feature looks like a MUST for Fluentbit Windows Container to collect Windows Logs, :(