这个是我用的配置，如下：

<match td.*.*>
  @type tdlog
  apikey YOUR_API_KEY
  auto_create_table
  buffer_type file
  buffer_path /var/log/td-agent/buffer/td
  <secondary>
    @type file
    path /var/log/td-agent/failed_records
  </secondary>
</match>
<match debug.**>
  @type stdout
</match>
<source>
  @type forward
</source>
<source>
  @type http
  port 8888
</source>
<source>
  @type debug_agent
  bind 127.0.0.1
  port 24230
</source>
<source>
  @type tail
  path /var/log/nginx/moat.access.log
  pos_file /var/log/td-agent/moat-nginx-access.log.pos
  tag moat.nginx.access
  format /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" "(?<forwarded>[^\"]*)") (?<request_id>[^ ]*) (?<request_time>[^ ]*)$/
  time_format %d/%b/%Y:%H:%M:%S %z
</source>
<source>
  @type tail
  path /var/log/nginx/moat.error.log
  pos_file /var/log/td-agent/moat-nginx-error.log.pos
  tag moat.nginx.error
  format /^(?<time>[^ ]+ [^ ]+) \[(?<log_level>.*)\] (?<pid>\d*).(?<tid>[^:]*): (?<message>.*)$/
  time_format %Y/%m/%d %H:%M:%S
</source>
<filter moat.nginx.*>
  @type record_transformer
  <record>
    hostname ${hostname}
    area usa
  </record>
</filter>
<match moat.nginx.*>
  @type elasticsearch
  logstash_format true
  host 172.31.4.58
  port 9200
  logstash_prefix shaohualee-nginx-qa
  type_name fluentd
  content_type application/json
  template_name shaohualee-nginx
  template_file /etc/td-agent/shaohualee-nginx.json
  template_overwrite true
</match>
<source>
  @type tail
  path /opt/app/security-moat-sqa/logs/moat.log
  pos_file /var/log/td-agent/moat-api-access.log.pos
  tag moat.api.access
  <parse>
    @type multi_format
    <pattern>
      format /^(?<level>[^ ]*) \[(?<time>[^\]]*)\] "(?<service>[\S\s]+)" -- "(?<path>[\S\s]+)" "(?<app_version>[\S\s]+)" "(?<phone_model>[\S\s]+)" (?<token>\S+) (?<open_udid>\S+) (?<country>\S+) (?<language>\S+) (?<request_id>\S+) (?<user_id>\S+) (?<station_sn>\S+) (?<device_sn>\S+) (?<latency>[^ ]*) (?<code>[^ ]*) "(?<message>[\S\s]+)" (?<params>[\s\S]*)$/
      time_key time
    </pattern>
    <pattern>
      format /^(?<level>[^ ]*) \[(?<time>[^\]]*)\] "(?<service>[\S\s]+)" ~~ "(?<tag>[\S\s]+)" (?<action_id>\S+) (?<action_sub_id>\S+) (?<latency>[^ ]*) "(?<message>[\S\s]+)" (?<params>[\s\S]*)$/
      time_key time
    </pattern>
  </parse>
  time_format %Y-%m-%dT%H:%M:%S%z
</source>
<source>
  @type tail
  path /opt/app/security-moat-dev/logs/moat.log
  pos_file /var/log/td-agent/boat-api-access.log.pos
  tag moat.api.access
  <parse>
    @type multi_format
    <pattern>
      format /^(?<level>[^ ]*) \[(?<time>[^\]]*)\] "(?<service>[\S\s]+)" -- "(?<path>[\S\s]+)" "(?<app_version>[\S\s]+)" "(?<phone_model>[\S\s]+)" (?<token>\S+) (?<open_udid>\S+) (?<country>\S+) (?<language>\S+) (?<request_id>\S+) (?<user_id>\S+) (?<station_sn>\S+) (?<device_sn>\S+) (?<latency>[^ ]*) (?<code>[^ ]*) "(?<message>[\S\s]+)" (?<params>[\s\S]*)$/
    time_key time
    </pattern>
    <pattern>
      format /^(?<level>[^ ]*) \[(?<time>[^\]]*)\] "(?<service>[\S\s]+)" ~~ "(?<tag>[\S\s]+)" (?<action_id>\S+) (?<action_sub_id>\S+) (?<latency>[^ ]*) "(?<message>[\S\s]+)" (?<params>[\s\S]*)$/
    time_key time
    </pattern>
  </parse>
  time_format %Y-%m-%dT%H:%M:%S%z
</source>
<filter moat.api.*>
  @type record_transformer
  <record>
    hostname ${hostname}
    area usa
  </record>
</filter>
<match moat.api.*>
  @type elasticsearch
  logstash_format true
  host 172.31.4.58
  port 9200
  logstash_prefix shaohualee-api-sqa
  type_name fluentd
  content_type application/json
  template_name shaohualee-api
  template_file /etc/td-agent/shaohualee-api.json
  template_overwrite true
</match>
<source>
  @type tail
  path /opt/app/security-moat-sqa/logs/logging.log
  pos_file /var/log/td-agent/moat-logging-report.pos
  tag logging.report.moat
  <parse>
    @type json
  </parse>
</source>
<source>
  @type tail
  path /opt/app/security-emqtt-sqa/logs/logging.log
  pos_file /var/log/td-agent/boat-logging-report.pos
  tag logging.report.boat
  <parse>
    @type json
  </parse>
</source>
<match logging.report.*>
  @type elasticsearch
  logstash_format true
  host 172.31.4.58
  port 9200
  logstash_prefix logging-short-qa
  type_name doc
  content_type application/json
</match>
<system>
  log_level error
</system>
#@include conf.d/*.conf

可以这样子在centos7上启动td-agent

sudo systemctl start td-agent.service
sudo systemctl status td-agent.service #这个很有用，可以查看日志在哪