Docker Cookbook

9.7 Managing Logspout Routes to Store Container Logs | 285

---

Discussion
To manage the log streams, the API exposes a 
/routes
route. The standard HTTP
verbs 
GET
, 
DELETE
, and 
POST
can be used to list, delete, and update the streaming end‐
points, respectively:
root@1fbb2f9636a8:/# curl http://logspout:8000/routes
[
{
"id": "e508de0c9689",
"target": {
"type": "syslog",
"addr": "192.168.34.11:5000"
}
}
]
root@1fbb2f9636a8:/# curl http://logspout:8000/routes/e508de0c9689
{
"id": "e508de0c9689",
"target": {
"type": "syslog",
"addr": "192.168.34.11:5000"
}
}
root@1fbb2f9636a8:/# curl -X DELETE http://logspout:8000/routes/e508de0c9689
root@1fbb2f9636a8:/# curl http://logspout:8000/routes
[]
root@1fbb2f9636a8:/# curl -X POST \
-d '{"target": {"type": "syslog", \
"addr": "192.168.34.11:5000"}}' \
http://logspout:8000/routes
{
"id": "f60d30502654",
"target": {
"type": "syslog",
"addr": "192.168.34.11:5000"
}
}
root@1fbb2f9636a8:/# curl http://logspout:8000/routes
[
{
"id": "f60d30502654",
"target": {
"type": "syslog",
"addr": "192.168.34.11:5000"
}
}
]
286 | Chapter 9: Monitoring Containers

---

You can create a route to 
Papertrail
that provides automatic backup
to Amazon S3.
9.8 Using Elasticsearch and Kibana to Store and Visualize
Container Logs
Problem
Recipe 9.6
 uses 
Logstash
 to receive logs and send them to 
stdout
. However, Logstash
has many 
plug-ins
 that allow you to do much more. You would like to go further and
use 
Elasticsearch
to store your container logs.
Solution
Start an Elasticsearch and a Kibana container. 
Kibana
is a dashboard that allows you
to easily visualize and query your Elasticsearch indexes. Start a Logstash container by
using the default configuration from the 
ehazlett/logstash
image:
$ docker run --name es -d -p 9200:9200 -p 9300:9300 ehazlett/elasticsearch
$ docker run --name kibana -d -p 80:80 ehazlett/kibana
$ docker run -d --name logstash -p 5000:5000/udp \
--link es:elasticsearch ehazlett/logstash \
-f /etc/logstash.conf.sample
Notice that the Logstash container is linked to the Elasticsearch
container. If you do not link it, Logstash will not be able to find the
Elasticsearch server.
With the container running, you can open your browser on port 80 of the Docker
host where you are running the Kibana container. You will see the Kibana default
dashboard. Select Sample Dashboard to extract some information from your index
and build a basic dashboard. You should see the logs obtained from hitting the Nginx
server, as shown in 
Figure 9-1
.