Forward Docker log to logstash using syslog driver

0
votes

I need to forward docker logs to a ELK stack.

The administrator of the stack filters my log according to the type parameter of the message. Right now I use filebeat and have to set the document_type parameter so the Logstash configuration filters my messages properly.

I am now trying to avoid using Filebeat, because I am going to instantiate my EC2 machines on demand, and did not want to have to install filebeat on each of them on runtime.

I already saw that there is a syslog driver among others available. I set the syslog driver, and the messages go to Logstash, but I am not able to find how to set a value for the document_type like in filebeat. How can I send this metadata to Logstash using Syslog driver, or any other Docker native driver?

Thanks!

1
dockerlogstashsyslog
Hi, I've already set up syslog as driver (docker run --log-driver=syslog), but the question is: How to send the document_type metadata when to logstash when I use the driver. Thanks! - Marcelo Flores

1 Answers

1
votes

Can't you give your syslog output a tag like so:

docker run -d --name nginx --log-driver=syslog --log-opt syslog-address=udp://LOGSTASH_IP_ADDRESS:5000 --log-opt syslog-tag="nginx" -p 80:80 nginx

And then in your logstash rules:

filter {
  if "nginx" in [tags] {
    add_field => [ "type", "nginx" ]
  }
}