The text_with_headers serializer (HDFS sink serializer) allows to save the Flume event headers rather than discarding them. The output format consists of the headers, followed by a space, then the body payload. We would like to drop the body and retain the headers only. For the HBase sink, the "RegexHbaseEventSerializer" allows us to transform the events. But I am unable to find such a provision for the HDFS sink.
You can set serializer property to header_and_text, which outputs both the headers and the body.
For example:
agent.sinks.my-hdfs-sink.type = hdfs
agent.sinks.my-hdfs-sink.hdfs.fileType = DataStream
...
# very important
agent.sinks.my-hdfs-sink.serializer = header_and_text
来源：https://stackoverflow.com/questions/27834950/is-it-possible-to-write-flume-headers-to-hdfs-sink-and-drop-the-body