Using ubuntu cloud-init to setup logging to splunk

Question

I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.

I would like to know how I can tell rsyslog to log to a splunk server (actually a splunk storm server) via the cloud-init configuration. Preferably, this would be done very early in the boot/config process so as to capture as much of the boot process logs themselves as possible.

Answer 1

Looks like there's a config provider for exactly this case; to throw a TCP syslog stream at splunk.example.com:

rsyslog:
 - '$RepeatedMsgReduction off'
 - filename: 30-splunk.conf
   content: '*.*   @@splunk.example.com'