rsyslogd-aggregation: Add revised rsyslogd-aggregation article

[cosmo0920]

Prior article is https://www.fluentd.org/guides/recipes/rsyslogd-aggregation.
Related to #566.

Signed-off-by: Hiroshi Hatake [email protected]

[cosmo0920]

@fujimotos Could you kindly take a look?
Currently, rsyslog-aggregation is outdated.
We should provide up-to-date article about rsyslog aggregation with Fluentd.

[fujimotos]

I'm looking at this patch and wondering: did you actually test this
article and make sure it works?

For example, won't this configuration fails to catch tags like
"rsyslog.foo.baa"?

https://github.com/fluent/fluentd-docs/pull/611/files#diff-ca4e5af7fe143f2988ad73897d346183R118

Another point. Why do we need to install Elasticsearch plugin manually
on td-agent3?

https://github.com/fluent/fluentd-docs/pull/611/files#diff-ca4e5af7fe143f2988ad73897d346183R60

I also see several links pointing to void (e.g. "/download") so please:

1. Test this article yourself and confirm it works
2. Make sure links in this article are consistent

Tell me if you have done them.

[cosmo0920]

For example, won't this configuration fails to catch tags like
"rsyslog.foo.baa"?

https://github.com/fluent/fluentd-docs/pull/611/files#diff-ca4e5af7fe143f2988ad73897d346183R118

Original article also contains such error.

Another point. Why do we need to install Elasticsearch plugin manually
on td-agent3?

https://github.com/fluent/fluentd-docs/pull/611/files#diff-ca4e5af7fe143f2988ad73897d346183R60

Sometimes Elasticsearch and elasticsearch-ruby which is dependent gem for fluent-plugin-elasticsearch conflict its compatibility.
td-agent3 is shipped with latest fluent-plugin-elasticsearch and elasticsearch-ruby, but it causes transport error between Fluentd and ES server.
This issue always bothering fluent-plugin-elasticsearch users.

I'll add a note or link for this issue.

[cosmo0920]

I decided that this PR should be closed because original syslog-aggregation article is not totally outdated.
We should update another totally outdated article.
If you want to update this article, please update yourself, thanks.

[fujimotos]

Note that the original goal of #566 was to upgrade the outdated articles to be
"fully up to date", so that we can present a set of latest, easy-to-follow
technical guides (or showcases) to users.

So, for example, in #587 and #567 I did:

1. Fully revise the content of the articles (e.g. fixing grammar,
   improving code examples and reorganizing the overall structure etc.)

2. Confirm it actually works, using actual instances of fluentd, rsyslog,
   and graylog I launched on my test environment.

3. Take screenshots and replace old ones in the articles.

If you think you can do, I'd like you to follow this standard of work.