0

I need to forward docker logs to a ELK stack.

The administrator of the stack filters my log according to the type parameter of the message. Right now I use filebeat and have to set the document_type parameter so the Logstash configuration filters my messages properly.

I am now trying to avoid using Filebeat, because I am going to instantiate my EC2 machines on demand, and did not want to have to install filebeat on each of them on runtime.

I already saw that there is a syslog driver among others available. I set the syslog driver, and the messages go to Logstash, but I am not able to find how to set a value for the document_type like in filebeat. How can I send this metadata to Logstash using Syslog driver, or any other Docker native driver?

Thanks!

1
  • Hi, I've already set up syslog as driver (docker run --log-driver=syslog), but the question is: How to send the document_type metadata when to logstash when I use the driver. Thanks! May 15, 2017 at 15:07

1 Answer 1

1

Can't you give your syslog output a tag like so:

docker run -d --name nginx --log-driver=syslog --log-opt syslog-address=udp://LOGSTASH_IP_ADDRESS:5000 --log-opt syslog-tag="nginx" -p 80:80 nginx

And then in your logstash rules:

filter {
  if "nginx" in [tags] {
    add_field => [ "type", "nginx" ]
  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.