fluentbit-validator

# Fluent Bit Validator Use this skill to run deterministic, repeatable validation for Fluent Bit classic-mode configs. ## Trigger Phrases Use this skill when prompts look like: - "Validate this `fluent-bit.conf` before deploy" - "Lint my Fluent Bit config and report issues" - "Check tag routing and output matches in Fluent Bit" - "Run security checks for Fluent Bit config" - "Dry-run Fluent Bit config and tell me what failed" ## Execution Model Run steps in order. Do not skip Stage 0. ### Stage 0: Precheck (Required) Run from skill directory: ```bash cd devops-skills-plugin/skills/fluentbit-validator ``` Check required and optional binaries: ```bash command -v python3 >/dev/null 2>&1 && echo "python3: available" || echo "python3: missing" command -v fluent-bit >/dev/null 2>&1 && echo "fluent-bit: available" || echo "fluent-bit: missing (dry-run will be skipped)" ``` Precheck protocol: - If `python3` is missing: stop script-based validation, report blocker, and switch to manual config review only. - If `fluent-bit` is missing: continue static checks, skip dry-run, and record a `Recommendation` explaining skip reason and next step. ### Stage 1: Static Validation (Required) Default command: ```bash python3 scripts/validate_config.py --file <config-file> --check all ``` Use targeted checks only when requested: ```bash python3 scripts/validate_config.py --file <config-file> --check structure python3 scripts/validate_config.py --file <config-file> --check sections python3 scripts/validate_config.py --file <config-file> --check tags python3 scripts/validate_config.py --file <config-file> --check security python3 scripts/validate_config.py --file <config-file> --check performance python3 scripts/validate_config.py --file <config-file> --check best-practices python3 scripts/validate_config.py --file <config-file> --check dry-run ``` Strict CI gate (optional): ```bash python3 scripts/validate_config.py --file <config-file> --check all --fail-on-warning ``` ### Stage 2: Dry-Run Handling (Conditional) Dry-run command: ```bash fluent-bit -c <config-file> --dry-run ``` Skip protocol: - If `fluent-bit` is unavailable, do not fail static validation by default. - Emit one explicit finding: - `Recommendation: Dry-run skipped because fluent-bit binary is not available in PATH; run dry-run in CI or a Fluent Bit runtime image.` - If user explicitly requires dry-run as a release gate, run: ```bash python3 scripts/validate_config.py --file <config-file> --check dry-run --require-dry-run ``` - In release-gate mode, missing `fluent-bit` must be reported as `Error`. ### Stage 3: Reference Lookup (Optional) Use only when plugin/parameter behavior is unclear after local checks. Lookup order: 1. Context7 Fluent Bit docs. 2. Official docs at `docs.fluentbit.io`. 3. Broader web search limited to official/plugin sources. Capture only: - required fields, - allowed values and defaults, - version caveats relevant to the user config. ### Stage 4: Report and Remediation (Required) Use exactly these severity labels: - `Error` - `Warning` - `Recommendation` Do not introduce alternate labels (`Info`, `Best Practice`, `Critical`, etc.). Report format: ```text Validation Report: <config-file> Error: - <blocking issue> Warning: - <non-blocking risk> Recommendation: - <improvement or skipped-step guidance> ``` Remediation flow: 1. Present findings with file/line context when available. 2. Ask for approval before changing user files. 3. Apply approved changes. 4. Re-run the same validation command(s). 5. Return delta: what changed, what remains, and final status. No-issue fast path: - If no findings exist, return a short pass summary and note whether dry-run was executed or skipped. ## Fallback Matrix | Constraint | Behavior | |---|---| | `python3` missing | Stop scripted validator, report blocker as `Error`, provide manual review-only output. | | `fluent-bit` missing | Continue static checks, skip dry-run, emit one `Recommendation` with next step. | | No network/docs access | Continue local validation, report unknown plugin details as `Warning` with explicit "doc lookup deferred". | | User requests report-only | Do not edit files; return findings and rerun command suggestion. | ## Canonical Flows ### Full validation flow ```bash bash scripts/validate.sh --precheck python3 scripts/validate_config.py --file tests/valid-basic.conf --check all ``` ### Constrained environment flow (`fluent-bit` unavailable) ```bash bash scripts/validate.sh --precheck python3 scripts/validate_config.py --file tests/invalid-security-issues.conf --check all --json ``` Expected outcome: - Static findings still produced. - Dry-run skipped and reported under `Recommendation`. ## Done Criteria Work is done only when all are true: - Precheck was executed and binary availability was stated explicitly. - Validation command(s) and scope are clear and reproducible. - All findings use only `Error`, `Warning`, `Recommendation`. - Dry-run path is explicit: executed or skipped with reason. - Fallback behavior for tool/runtime constraints is documented in output. - If fixes were applied, validation was re-run and post-fix status was reported. ## Local Assets - `scripts/validate_config.py`: main validator. - `scripts/validate.sh`: wrapper and environment precheck helper. - `tests/*.conf`: sample valid/invalid configs. - `tests/test_validate_config.py`: regression coverage for parser and severity behavior. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/akin-ozer) — claim your Tome and manage your conversions. <!-- tomevault:4.0:skill_md:2026-04-11 -->