cogniteev/rsyslogstash repository overview

⁠$(rsyslog 8 | logstash) Dockerfile

Forward logs to Logstash⁠ or any syslog server.

This repository contains Dockerfile of the latest version of Rsyslog 8⁠ configured to push logs to Logstash⁠ for Docker⁠ automated build⁠ published to the public Docker Hub Registry⁠.

⁠Base Docker Image

• cogniteev/rsyslog8:latest⁠

⁠Installation

1. Install Docker⁠

2. Download automated build⁠: docker pull cogniteev/rsyslogstash

⁠Provides a /var/log/containers volume

This image forwards to a syslog server .log files available in /var/log/containers directory.

It is recommended to create a /var/log/containers data-only container, mount this volume on every application containers and make sure they write their log files in this directory.

⁠Provides a syslog upstream server

⁠link to a syslog container

You can link a logstash container (configured with a syslog input listening on port 514). Make sure to name the logstash container logstash.

Example:

$ sudo docker run -d -l logstash-container:logstash cogniteev/rsyslogstash

⁠Specify LOGSTASH environment variable

You can also specify the LOGSTASH environment variable providing syslog server address:

$ sudo docker run -d -e LOGSTASH=1.2.3.4:514 cogniteev/rsyslogstash

⁠Example

Check the sample application⁠ using docker-compose. 2 containers are emitting logs in /var/log/containers volume, read by a cogniteev/rsyslogstash container forwarding them to a logstash container, which is emitting received messages to its standard output.

docker-compose up

Wait a few seconds, and you will see logstash containers emitting logs pushed by application containers.

⁠License

The cogniteev/rsyslogstash image is licensed under the Apache License, Version 2.0. See LICENSE for full license text.