fest/logspout repository overview

⁠Logspout

This image use Logspout⁠ with Logspout-logstash plugin⁠ that provide functionality to send all logs to Logstash.

Logspout connect to all containers on same node, gather all their logs from STDOUT and STDERR and proxy it to Logstash.

⁠Tags

Images in this repository are tagged as follows using Semver⁠:

• 2.1.3: Based on gliderlabs/logspout:v3.2.13
• 2.1.2: Based on gliderlabs/logspout:v3.2.6
• 2.0.0: Based on gliderlabs/logspout:v3.2.3

⁠Usage

Logspout requires running instance of Monasca Log Agent⁠.

To add service dimension that you would be able to filter by in Kibana you need to initialize running containers with LOGSTASH_FIELDS environment variable containing kye=value pair of service key and service name as a value e.g.: "service=mysql". Logspout will pickup this env variable and send proper data to the Monasca Log Agent.

⁠Multiline logging

To handle multiline logging⁠ you need to pass a regex as a environment variable, which matches the start of the multiline blocks e.g.: MULTILINE_PATTERN=^(\\[?\\d{4}-\\d{2}-\\d{2}|{)

This example matches logs, which:

• start with a timestamp with format YYYY-MM-DD or [YYYY-MM-DD
• are json-logs

Note that in the case of a service generates logs, which don't follow any of these patterns, the multiline bock will be chunked every period defined with MULTILINE_FLUSH_AFTER (default: 500 ms)

⁠Configuration

⁠Additional files

Files build.sh and modules.go are used by Logspout Dockerfile (with ONBUILD COPY command) and allow us to build resulting binary with needed plugin.

⁠Build

docker build --no-cache -t fest/logspout:2.1.3 logspout