Categories
Docker Infrastructure Snippets

Logs with docker and logstash

It would be nice to have all container logs from a docker cluster sent to … let’s say, an ELK stack. Right? Right. So we did: on each host in the cluster, we use the GELF log driver to send all logs to a logstash instance the logstash instance clones each request using type “ELK” […]

Categories
Snippets

Logstash, clone filter & add_field mysteries

That’s a really great piece of documentation. This does not work: # let’s clone each event, one goes to somewhere, one goes to somewhere else. # note this was copy-pasted from the docs! # see here: https://is.gd/QSHNps # again. THIS DOES NOT WORK. filter { clone { add_field => { “token” => “ABCDEF” } } […]

Categories
Infrastructure

Testing logstash configs with Docker

Now this is really not rocket science, but since I might do this more often, I don’t want to google every time. Prepare your directories ./tmp # THIS IS YOUR WORKING DIRECTORY |- patterns/ # optional | |- patternfile1 # optional | |- patternfile2 # optional |- logs.log |- logstash.conf Prepare your logstash config # […]