Docker Cookbook

282 | Chapter 9: Monitoring Containers

---

Recipe 9.5
) functionality. You can still use Logspout, but the logging driver also gives
you a straightforward way to redirect your logs.
Let’s install Logspout on one Docker host to collect logs from an Nginx container.
You run 
nginx
on port 80 of the host. Start 
logspout
, mount the Docker Unix
socket 
/var/run/docker.sock
in 
/tmp/docker.sock
, and specify a syslog endpoint (here
you use another Docker host with the IP address of 192.168.34.11):
$ docker pull nginx
$ docker pull gliderlabs/logspout
$ docker run -d --name webserver -p 80:80 nginx
$ docker run -d --name logspout -v /var/run/docker.sock:/tmp/docker.sock \
gliderlabs/logspout syslog://192.168.34.11:5000
To collect the logs, you’ll use a Logstash container running at 192.168.34.11. To sim‐
plify things, it will listen for syslog input on UDP port 5000 and output everything to
stdout
on the same host. Start by pulling the 
logstash
image. (This example uses the
image 
ehazlett/logstash
, but there are many Logstash images that you might want to
consider.) After pulling the image, you’ll build your own and specify a custom Log‐
stash configuration file (this is based on the 
/etc/logstash.conf.sample
from the 
eha‐
zlett/logstash
image):
$ docker pull ehazlett/logstash
$ cat logstash.conf
input {
tcp {
port => 5000
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} \
%{SYSLOGHOST:syslog_hostname} \
%{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: \
%{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
stdout { codec => rubydebug }
}