Setup logging

[etoews]

No description provided.

[etoews]

It's looking like we won't be able to use logging drivers with overlay networks. 😞

moby/moby#20370 (comment)

[etoews]

I had a bit of success using Filebeat to log directly to ElasticSearch with overlay networks.

All logs on the node are getting shipped, including Swarm container logs, but I think we should be able to filter those out with Filebeat config (config reference).

Filebeat Dockerfile

FROM debian:jessie

RUN apt-get -y update
RUN apt-get -y install apt-transport-https
RUN apt-get -y install curl
RUN curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add -
RUN echo "deb https://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list

RUN apt-get -y update
RUN apt-get -y install filebeat

ADD filebeat.yml /etc/filebeat/filebeat.yml

ENTRYPOINT ["/usr/bin/filebeat", "-e", "-v", "-c", "/etc/filebeat/filebeat.yml"]

filebeat.yml

filebeat:
  # List of prospectors to fetch data.
  prospectors:
    -
      paths:
        - /var/lib/docker/containers/*/*.log
      input_type: log
      ignore_older: 5m
output:
  elasticsearch:
    hosts: ["elasticsearch:9200"]

Commands

docker build -t filebeat .
docker run --detach --name=filebeat --net logging -v /var/lib/docker:/var/lib/docker filebeat