Docker container with Logstash service based on sath89/jdk7
docker-compose example:
Default configuration is:
input { log4j { tags => "log4j" } tcp { port => 9290 tags => "tcpin" codec => "json" } } output { elasticsearch { embedded => true } }
#elastic search is embedded => true
#for proper working of embedded elasticsearch add aditional port forwarding -p 9200:9200
docker run -itd -p 9292:9292 -p 4560:4560 -p 9290:9290 -p 9200:9200 sath89/logstash
Usage example1 (OLD/LowLevel):
docker run -i -t --rm --dns=172.17.42.1 --name=logstash -p 9292:9292 -p 4560:4560 -p 9290:9290 sath89/logstash \
/opt/logstash-1.5.0/bin/logstash -e ' \
input { log4j { tags => "log4j" } \
tcp { port => 9290 tags => "tcpin" codec => "json" } } \
output { elasticsearch { host => "elasticsearch.domain.com" } } '
This example uses external elasticsearch service. If you want to use embedded - the you could set embedded => true in the config. More info here
Usage example2:
docker run -i -t --rm --dns=172.17.42.1 --name=logstash -p 9292:9292 -p 4560:4560 -p 9290:9290 \
-e CONFIG='input { log4j { tags => "log4j" } tcp { port => 9290 tags => "tcpin" codec => "json" } } output { elasticsearch { host => "elasticsearch.domain.com" }' \
sath89/logstash
Here is an example how to send logs to logstash via log4j in log4j.properties example
Here is an example for tcp socket in ncat.sh and in journalncat.service
docker pull sath89/logstash