logspout icon indicating copy to clipboard operation
logspout copied to clipboard

No logs appearing in Papertrail

Open cjohansen opened this issue 8 years ago • 4 comments

I'm trying to run logspout to put my logs in Papertrail without much luck. Here's the output of docker logs logspout:

# logspout v3.1 by gliderlabs
# adapters: udp tls raw syslog tcp
# options : persist:/mnt/routes
# jobs    : http[logs,routes]:80 pump routes
# routes  :
#   ADAPTER	ADDRESS				CONTAINERS				SOURCES	OPTIONS
#   syslog+tls	logs.papertrailapp.com:xxxx	myapp1,myapp2		map[]

Which looks right to me. Tailing the log locally over http (e.g. curl http://localhost:8000/logs) shows me the relevant log messages. However, with the 3.2.1 container, all I could see in Papertrail was a whole bunch of these:

May 24 13:39:03 my-hostname dockerd:  time="2017-05-24T11:39:03.246506810Z" level=error msg="Error streaming logs: invalid character '\\x00' looking for beginning of value"

Looks like the same thing that was reported https://github.com/gliderlabs/logspout/issues/246#issuecomment-286284186, so I tried the recommendation there, running v3.1 instead. With 3.1 the error goes away, but I still do not see a single log statement in Papertrail (the http endpoint is still logging messages as expected). Am I holding it wrong?

cjohansen avatar May 24 '17 11:05 cjohansen

The logspout container doesn't have any more logs. Where can I find some information about logspout's attempts to send logs to papertrail?

cjohansen avatar May 24 '17 12:05 cjohansen

I assumed that all the filters supported a comma-separated list of containers. Turns out this is not the case, so the above filter actually filters on container with name "myapp1,myapp2", instead of the two intended containers. Worked around this with labels instead. I would suggest making this limitation on filter.name explicit in the Readme (or supporting a comma-separated list of names for filter.name).

cjohansen avatar May 26 '17 12:05 cjohansen

I agree it would be preferable to support a comma separated list. I haven't been in that part of the code yet but I'd be interested to see a PR for this change.

michaelshobbs avatar May 26 '17 16:05 michaelshobbs

@cjohansen how did you started the logspout? When I run it as:

docker run --restart=always --name logspout --hostname logspout -d -v=/var/run/docker.sock:/var/run/docker.sock gliderlabs/logspout:master syslog://logs6.papertrailapp.com:$PORT

works for me.

mjablecnik avatar Oct 11 '17 08:10 mjablecnik