Docker Cookbook

9.6 Using Logspout to Collect Container Logs | 283

---

$ cat Dockerfile
FROM ehazlett/logstash
COPY logstash.conf /etc/logstash.conf
ENTRYPOINT ["/opt/logstash/bin/logstash"]
$ docker build -t logstash .
You are now ready to run the Logstash container, and bind port 5000 of the container
to port 5000 of the host listening for UDP traffic:
$ docker run -d --name logstash -p 5000:5000/udp logstash -f /etc/logstash.conf
Once you open your browser to access Nginx running on the first Docker host you
used, logs will appear in the Logstash container:
$ docker logs logstash
...
{
"message" => "<14>2015-03-10T13:00:39Z 889bbf0753a8 nginx[1]: 192.168.34.1 - \
- [10/Mar/2015:13:00:39 +0000] \"GET / HTTP/1.1\" 200 612 \"-\"
\"Mozilla/5.0 \
(Macintosh; Intel Mac OS X 10_8_5) \
AppleWebKit/600.3.18 (KHTML, like Gecko) \
Version/6.2.3 Safari/537.85.12\" \"-\"\n",
"@version" => "1",
"@timestamp" => "2015-03-10T13:00:36.241Z",
"type" => "syslog",
"host" => "192.168.34.10",
"tags" => [
...
Discussion
To simplify testing Logspout with Logstash, you can clone the repository accompany‐
ing this book and go to the 
ch09/logspout
directory. A Vagrantfile will start two
Docker hosts and pull the required Docker images on each host:
$ git clone https://github.com/how2dock/docbook.git
$ vagrant up
$ vagrant status
Current machine states:
w running (virtualbox)
elk running (virtualbox)
...
On the 
web server
node, you can run Nginx and the Logspout container. On the 
elk
node, you can run the Logstash container:
$ vagrant ssh w
$ docker run --name nginx -d -p 80:80 nginx
$ docker run -d --name logspout -v /var/run/docker.sock:/tmp/docker.sock \
gliderlabs/logspout syslog://192.168.34.11:5000