Sending Docker container logs to ELK Stack by configuring the logging drivers - Easy Method

logging docker syslog elastic-stack logstash-configuration
kisHoR picture kisHoR · Jan 25, 2017 · Viewed 10.9k times · Source

I usually run applications as docker containers because of its high flexibility and availability. Is there a way to get the container logs into my logstash server.

Answer

kisHoR picture kisHoR · Jan 25, 2017

Docker includes multiple logging mechanisms to help you get information from running containers and services by means of logging drivers.

Each Docker daemon has a default logging driver, which each container uses unless you configure it to use a different logging driver.

You can simply get your container logs by configuring Logstash as follows and running the container whose logs are to be viewed by changing its default log driver to syslog.

#logstash.conf

input {
  tcp {
    port => 5000
  }
}

output {
  stdout {}
}

The below two commands will display the hello-world container logs in logstash.

docker run -it --rm --name=logstash -p 5000:5000 -f /path/to/logstash.conf

docker run --log-driver=syslog --log-opt syslog-address=tcp://<logstash-system-ip>:5000 hello-world

The output of Logstash can even sent to elasticsearch by simply configuring the output section as, 

  elasticsearch {

    hosts => ["<elastic-system-ip>:9200"]

  }

Visit https://docs.docker.com/engine/admin/logging/overview/

Related questions

Docker- How to use syslog to record logs on host machine?

I wish to keeps the logs of my container to a file in my host machine for every container. I read about doing the same via logging driver. Since my host machine runs ubuntu 14.04, which has rsyslog running by default, …

Read More
how to check syslog for ubuntu docker

I installed tutum/ubuntu in local vm's docker. When I login to ubuntu and run below command. logger "Test Logging" I can't find the file where this logged in. In my local system I can see the system.log or …

Read More
Java app in Docker container does not log to syslog properly

My Goal I have a couple of different containers running inside a host. They all share a volume with each other's /dev/log socket. The host forwards these logs to a central logging server. All the other containers logs are …

Read More