claude-plugins: scope the swarm-logs example by machine id
The worked example keyed a stream selector on `_HOSTNAME`, which the collector config warns against: a hostname is a config value two machines can share, so keying on it merges their streams. Use `_MACHINE_ID`, which is the field that actually distinguishes them. Refs #4460
This commit is contained in:
parent
c95f721f81
commit
d4551124f7
2 changed files with 50 additions and 2 deletions
|
|
@ -38,10 +38,15 @@ one, so a bare word matches across every hive in the swarm." There's no
|
|||
per-hive flag to fix this from the CLI side — scope it in the query
|
||||
string instead. The collector tags every log line with `_HOSTNAME`,
|
||||
`_MACHINE_ID`, and `_SYSTEMD_UNIT` as stream fields, so add one of those
|
||||
to a query you want confined to your own hive or service:
|
||||
to a query you want confined to your own machine or service:
|
||||
|
||||
Reach for `_MACHINE_ID` rather than `_HOSTNAME` when you mean one
|
||||
machine. A hostname is a configuration value, so two machines can carry
|
||||
the same one, and a query keyed on it silently merges their streams —
|
||||
the collector's own config warns about this case for exactly that reason.
|
||||
|
||||
```console
|
||||
$ swarm-logs query '_time:1h _stream:{_HOSTNAME="atlas"} "connection refused"'
|
||||
$ swarm-logs query '_time:1h _stream:{_MACHINE_ID="<id>"} "connection refused"'
|
||||
$ swarm-logs query '_time:1h _SYSTEMD_UNIT:="hive-agent.service"' --format json
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue