22

We have custom Docker web app running in Elastic Beanstalk Docker container environment. Would like to have application logs be available for viewing outside. Without downloading through instances or AWS console.

So far neither of solutions been acceptable. Maybe someone achieved centralised logging for Elastic Benastalk Dockerized apps?

Solution 1: AWS Console log download

not acceptable - requires to download logs, extract every time. Non real-time.

Solution 2: S3 + Elasticsearch + Fluentd

fluentd does not have plugin to retrieve logs from S3 There's excellent S3 plugin, but it's only for log output to S3. not for input logs from S3.

Solution 3: S3 + Elasticsearch + Logstash

cons: Can only pull all logs from entire bucket or nothing.

The problem lies with Elastic Beanstalk S3 Log storage structure. You cannot specify file name pattern. It's either all logs or nothing. ElasticBeanstalk saves logs on S3 in path containing random instance and environment ids:

s3.bucket/resources/environments/logs/publish/e-<random environment id>/i-<random instance id>/my.log@

Logstash s3 plugin can be pointed only to resources/environments/logs/publish/. When you try to point it to environments/logs/publish/*/my.log it does not work. which means you can not pull particular log and tag/type it to be able to find in Elasticsearch. Since AWS saves logs from all your environments and instances in same folder structure, you cannot chose even the instance.

Solution 4: AWS CloudWatch Console log viewer

It is possible to forward your custom logs to CloudWatch console. Do achieve that, put configuration files in .ebextensions path of your app bundle: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html

There's a file called cwl-webrequest-metrics.config which allows you to specify log files along with alerts, etc. Great!? except that configuration file format is neither yaml,xml or Json, and it's not documented. There is absolutely zero mentions of that file, it's format either on AWS documentation website or anywhere on the net. And to get one log file appear in CloudWatch is not simply adding a configuration line. The only possible way to get this working seem to be trial and error. Great!? except for every attempt you need to re-deploy your environment.

There's only one reference to how to make this work with custom log: http://qiita.com/kozayupapa/items/2bb7a6b1f17f4e799a22 I have no idea how that person reverse engineered the file format.

cons:

  • Cloudwatch does not seem to be able to split logs into columns when displaying, so you can't easily filter by priority, etc.
  • AWS Console Log viewer does not have auto-refresh to follow logs.
  • Nightmare undocumented configuration file format, no way of testing. Trial and error requires re-deploying whole instance.
7
  • As for "*/my.log", would the 'prefix' option to the s3 input work? "If specified, the prefix the filenames in the bucket must match (not a regexp)" Commented Dec 6, 2014 at 5:25
  • For the more general question of sending docker logs to logstash, I believe you can share a mountpoint between the host and the container. Put your logs there and ship them from the host. Commented Dec 6, 2014 at 5:27
  • A Fluentd maintainer here. Can you elaborate on how you want to get data out of S3? Commented Dec 18, 2014 at 1:04
  • @KiyotoTamura Basically same as Logstash's S3 plugin - point to S3 bucket and path. Plugin downloads logs periodically.
    – Roman
    Commented Dec 18, 2014 at 1:48
  • @KiyotoTamura I am not sure I understand your question. You're asking how that should be done on programming level or on configuration level? or on conceptual level? As in Logstash plugin it downloads logs using configured path pattern and S3 credentials.
    – Roman
    Commented Dec 18, 2014 at 1:51

5 Answers 5

1

Perhaps an AWS Lambda function is applicable?

Write some javascript that dumps all notifications, then see what you can do with those.

After an object is written, you could rename it within the same bucket?

Or notify your own log-management service about the creation of a new object?

Lots of possibilities there...

1
  • I also heard about this solution. Do you have some examples in mind?
    – aholbreich
    Commented Feb 3, 2017 at 9:34
0

I've started using Sumologic for the moment. There's a free trial and then a free tier (500mb /day, 7 day retention). I'm not out of the trial period yet and my EB app does literally nothing (it's just a few HTML pages serve by Nginx in a docker container. Looks like it could get expensive once you hit any serious amount of logs though.

It works ok so far. You need to create an IAM user that has access to the S3 bucket you want to read from and then it sucks the logs over to Sumologic servers and does all the processing and searching over there. Bit fiddly to set up, but I don't really see how it could be simpler and it's reasonably well-documented.

It lets you provide different path expressions with wildcards, then assign a "sourceCategory" to those different paths. You then use those sourceCategories to filter your log searching to a specific type of logging.

My plan long-term is to use something like your solution 3, but this got me going in very short order so I can move on to other things.

2
  • How do you use Sumologic with EB? There's no information anywhere except for this one Gist: gist.github.com/jorihardman/f3507764762e876cc9df
    – Roman
    Commented Apr 7, 2016 at 5:55
  • That one looks like it's streaming the logs directly from the instances to SumoLogic's servers. I configure my EB environments to "publish logs" (it puts the log files in your elastic beanstalk bucket). Then configure SumoLogic (on the sumologic website) with credentials that are allowed to read the logs from the EB bucket. SL then logs in, pulls the logs to their site and then processes the logs.
    – Shorn
    Commented Apr 7, 2016 at 6:12
0

You can use a Multicontainer environment, sharing the log folder to another docker container with the tool of your preference to centralize the logs, in our case we connected an Apache Flume to move the files to an HDFS. Hope this helps you with this.

0

The easiest method I found to do this was using papertrail via rsyslog and .ebextensions, however it is very expensive for logging everything.

The good part is with rsyslog you can essentially send your logs anywhere and you are not tied to papertrail.

example ebextension

0

I've found loggly to be the most convenient.
It is a hosted service which might not be what you want. However if you check out their setup page you can see a number of ways your situation is supported (docker specific solutions, as well as like 10 amazon specific options). Even if loggly isn't to your taste, you can look at those solutions and easily see how some of them could be applied to most any centralized logging solution you might use or write.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.