Using Fluentd to transfer data to DocumentDB - mongodb

Question

I can use Fluentd to transfer data to mongoDB built on AWS EC2, but I can't transfer data to DocumentDB, which is a managed service compatible with mongoDB.
The following is the td-agent.conf for transferring the json file saved in /var/log/test/bulk/ to mongoDB.
<source>
#type tail
path /var/log/test/bulk/*
tag bulk.*
format json
time_key time
time_format '%F %T.%N %z %Z'
pos_file /var/log/test/run/log-json.pos
read_from_head true
refresh_interval 5s
</source>
<match bulk.**>
#type record_reformer
tag test.${tag_parts[-3]}.${tag_parts[-2]}
</match>
<match test.**>
#type copy
<store>
#type forest
subtype mongo_replset
<template>
host hostname1:27017,hostname2:27017,hostname3:27017
replica_set rs0
database ${tag_parts[-2]}
collection ${tag_parts[-1]}
user ********
password ********
replace_dot_in_key_with __dot__
<buffer>
#type file
path /var/log/test/buffer-mongo/${tag_parts[-2..-1]}
chunk_limit_size 8m
queued_chunks_limit_size 64
flush_interval 1s
</buffer>
</template>
</store>
</match>
When transferring to DocumentDB, I changed the host in the conf file above to the cluster endpoint, but the following error occurred.
[warn]: #0 failed to flush the buffer. retry_time=0 next_retry_seconds=2021-09-14 10:26:56 +0900 chunk="5cbea78155b58ec0810e9fde94aa2355" error_class=Mongo::Error::NoServerAvailable error="No server is available matching preference: #<Mongo::ServerSelector::Primary:0x70233136498300 tag_sets=[] max_staleness=nil> using server_selection_timeout=30 and local_threshold=0.015"
Since TLS is enabled in DocumentDB, I wonder if I need to specify rds-combined-ca-bundle.pem to enable TLS. I think so, but I don't know how to do that.
(When I tested writing to DocumentDB in Python using the link, the above error occurred when TLS was disabled.)
Can you please tell me how to write data to DocumentDB with TLS enabled?

Answer 1

Amazon DocumentDB clusters are deployed within an Amazon Virtual Private Cloud (Amazon VPC). They can be accessed directly by Amazon EC2 instances or other AWS services that are deployed in the same Amazon VPC. Is the client application running in the same VPC and security group as the DocumentDB cluster?