Sending Docker container logs to ELK Stack by configuring the logging drivers - Easy Method

Question

I usually run applications as docker containers because of its high flexibility and availability. Is there a way to get the container logs into my logstash server.

Answer 1

Docker includes multiple logging mechanisms to help you get information from running containers and services by means of logging drivers.

Each Docker daemon has a default logging driver, which each container uses unless you configure it to use a different logging driver.

You can simply get your container logs by configuring Logstash as follows and running the container whose logs are to be viewed by changing its default log driver to syslog.

#logstash.conf

input {
  tcp {
    port => 5000
  }
}

output {
  stdout {}
}

The below two commands will display the hello-world container logs in logstash.

docker run -it --rm --name=logstash -p 5000:5000 -v /path/to/logstash.conf:/usr/share/logstash/config/logstash.yml docker.elastic.co/logstash/logstash:7.14.0

docker run --log-driver=syslog --log-opt syslog-address=tcp://<logstash-system-ip>:5000 hello-world

The output of Logstash can even sent to elasticsearch by simply configuring the output section as,

  elasticsearch {

    hosts => ["<elastic-system-ip>:9200"]

  }

Visit https://docs.docker.com/engine/admin/logging/overview/