The Timber Agent configuration file is written in TOML (v0.4.0). You can think of it as a super-powered cousin of INI syntax or a relaxed cousin of YAML. By default the Timber agent expects this file to be located at
/etc/timber.toml, but you can adjust this path by passing the
timber-agent --config /path/to/timber.toml
A simple config file looks like this:
1 2 3 4
default_api_key = "qcJtbeo4DJLsyTV83zkpWi1oh5s9N3Se" [[files]] path = "/var/log/yum.log"
When the Agent reads this configuration, it will start tailing
/var/log/yum.log and forwarding its contents.
The Timber Agent sends buffered log data on a regular time interval. You can set a custom
batch_period_secondsif you would like to send more or less frequently. We recommend sending more frequently so that the data transmissions are smaller, but the majority of users should not have to modify this value.
This is your main default API key. As you will see below, it is possible for each file to override the API key with a file specific API key. When this is not present, the default API key is used. Most users will only specify this key. Per file API keys are used in advanced circumstances. You can read more about that below in the
By default, the Timber Agent will check whether it is running on an AWS EC2 instance. If it is, it will pull down data about the instance from the metadata store and set it as context under the
If you would like to disable this beahvior, set
[[files]](array of tables)
[[files]]key is a repeatable key; each use of the key becomes an entry in the
filesarray (a file definition), specifying the list of files you want the Agent to tail. Here's a more advanced example:
1 2 3 4 5 6 7 8
default_api_key = "zVfL5A5GJKJAXf2GlmrRudjmHXFobdK2" [[files]] path = "/var/log/app/*.log" [[files]] path = "/path/to/another.log" api_key = "qcJtbeo4DJLsyTV83zkpWi1oh5s9N3Se"
Each key for
[[files]]is described below:
This is an optional key that allows you to override the
default_api_key. Note in the above example, both keys are present. If no
api_keyis specified, the
default_api_keywill be used. This gives you the ability to route specific files to different applications within Timber.
This is the absolute path to the file Timber should watch for logs. File globbing) is supported.
When this field is blank, the Timber Agent automatically gets the hostname of your system from the operating system and adds it as context to every log line (at the key
Setting a value for the
hostnamekey will override this behavior, and
context.system.hostnamewill be set to the value you provide.
The Agent tries to be intelligent about watching logs. By default it asks the underlying system to notify it of changes to the files being tailed. On Linux, this uses
inotify, on BSD-variants it uses
If you set
true, the Agent will instead read the file on a regular basis to check for changes.
If for some reason your system is incompatible or unreliable with file system events (for example, Docker on certain virtualization technologies has poor
inotifycompatiability), you should set