3rd-party log analysis tools

For the complete documentation index see: llms.txt

All documentation pages available in markdown.

This page describes how to add and configure Aerospike filtering and parsing rules for supported 3rd-party log ingestion tools. These rules break Aerospike logs into a format that can be read and used in custom alerts or dashboards.

Parsing rules are available for Fluent Bit and Splunk. Both of these tools parse Aerospike Database logs one line at a time.

Prerequisites

A running instance of Aerospike Database 6.0.0 or later.
A working installation of Fluent Bit or Splunk for ingesting Aerospike Database logs.

Configure Fluent Bit

Download the Aerospike parser file aerospike-fluent-bit-parsers.conf to the /etc/fluent-bit/ directory on the machine running Fluent Bit.

wget https://raw.githubusercontent.com/aerospike-community/aerolab/refs/heads/master/pkg/agi/ingest/thirdparty_tools/fluentbit/aerospike-fluent-bit-parsers.conf -P /etc/fluent-bit/

Download the Aerospike filter file aerospike-fluent-bit-filters.conf to the same /etc/fluent-bit/ directory as the parser file.

wget https://raw.githubusercontent.com/aerospike-community/aerolab/refs/heads/master/pkg/agi/ingest/thirdparty_tools/fluentbit/aerospike-fluent-bit-filters.conf -P /etc/fluent-bit/

Modify the [SERVICE] section of the Fluent Bit configuration file at /etc/fluent-bit/fluent-bit.conf to add the location of the Aerospike parser.

The [SERVICE] section should appear similar to the following:

# Parsers File (fluent-bit.conf)
# ============
# specify an optional 'Parsers' configuration file
# parsers_file /root/fluentbit/parsers.conf
parsers_file /etc/fluent-bit/aerospike-fluent-bit-parsers.conf

At the end of the same file, add an @INCLUDE directive to specify the location of the Aerospike filter file aerospike-fluent-bit-filters.conf.
```
@INCLUDE /etc/fluent-bit/aerospike-fluent-bit-filters.conf
```
Restart Fluent Bit so it loads the updated configuration.
Terminal window
```
systemctl restart fluent-bit
```

Configure Splunk

Create a custom Splunk app specifically for Aerospike logs. This creates a directory under /etc/splunk/etc/apps/ with the name of your app. See the Splunk documentation for details.
On the machine running Splunk, download the properties file aerospike_splunk_local_props.conf to your app’s /local/ directory with the name props.conf. Replace the placeholder in the following example with your app’s name as per your directory structure.
Terminal window
```
wget https://raw.githubusercontent.com/aerospike-community/aerolab/refs/heads/master/pkg/agi/ingest/thirdparty_tools/splunk/aerospike_splunk_local_props.conf -O /etc/splunk/etc/apps/YOUR_APP/local/props.conf
```
Download the local transforms file aerospike_splunk_local_transforms.conf to the same /local/ directory as the properties file, with the name transforms.conf. Replace the placeholder in the following example with your app’s name as per your directory structure.
Terminal window
```
wget https://raw.githubusercontent.com/aerospike-community/aerolab/refs/heads/master/pkg/agi/ingest/thirdparty_tools/splunk/aerospike_splunk_local_transforms.conf -O /etc/splunk/etc/apps/YOUR_APP/local/transforms.conf
```
Restart Splunk.

Verify

After you configure Fluent Bit or Splunk, confirm that Aerospike log lines are parsed into structured fields.

Fluent Bit

Confirm Fluent Bit is running:
Terminal window
```
systemctl status fluent-bit
```
Generate Aerospike log activity, then inspect Fluent Bit output or your downstream log store. Parsed Aerospike records should include extracted fields instead of raw log text only.

Splunk

In Splunk, search your Aerospike app index for recent Aerospike log events.
Confirm events show parsed fields from the props.conf and transforms.conf rules rather than unparsed _raw log lines only.