Send data via Docker to your Logstash instance provided by Logit.io

Docker

Collect and ship Docker container application logs to Logstash and Elasticsearch.

Filebeat is a lightweight shipper that enables you to send your Docker container application logs to Logstash and Elasticsearch. Configure Filebeat using the pre-defined examples below to start sending and analysing your Docker application logs.

Step 1 - Install Filebeat

deb (Debian/Ubuntu/Mint)

sudo apt-get install apt-transport-https
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo 'deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main' | sudo tee /etc/apt/sources.list.d/beats.list

sudo apt-get update && sudo apt-get install filebeat
My OS isn't here! Don't see your system? Check out the official downloads page for more options (including 32-bit versions).

Step 2 - Locate The Configuration File

deb/rpm /etc/filebeat/filebeat.yml

Change the owner of the filebeat.yml file to root to allow access to the docker container logs.


sudo chown root:root filebeat.yml
ls -la

Step 3 - Configure The Inputs

We want filebeat to read the container logs from /var/lib/docker/containers/*/*.log which is where docker's container logs are stored.

Add to your filebeat.inputs section the docker type.


filebeat.inputs:
- type: docker
  containers.ids:
    - '*'

If you do not want to read all container logs then you can specify the continer Id to logs from specific containers.

Step 4 - Configure Output

We'll be shipping to Logstash so that we have the option to run filters before the data is indexed.
Comment out the elasticsearch output block.

## Comment out elasticsearch output
#output.elasticsearch:
#  hosts: ["localhost:9200"]

Uncomment and change the logstash output to match below.

output.logstash:
    hosts: ["your-logstash-host:your-port"]
    loadbalance: true
    ssl.enabled: true

Step 5 - Validate Configuration

Let's check the configuration file is syntactically correct.

deb/rpm

sudo filebeat -e -c /etc/filebeat/filebeat.yml

Step 6 - Start Filebeat

Ok, time to start ingesting data!

deb/rpm

sudo systemctl enable filebeat
sudo systemctl start filebeat
expand view

Expand View

compact view

Compact View

Return to Search
Sign Up