Syslog: containers informations

[sgrunt91]

Hello,

I want to put my containers logs into my syslog server (running with syslog-ng). So I'm trying Logspout, and the logs are well sent to my syslog server. But there only the stout of all containers, mixed in one log file (somethink like docker-host.hostname/2018/06/user.notice.20180605.log). No container hostname or stack name (I'm using Rancher). I would like to add some fields that are in my labels to the log line to identify what kind of logs I have and make data extraction.

Is it possible?

here is my actual config:

docker-compose.yml

version: '2'
services:
  logspout:
    image: gliderlabs/logspout:latest
    environment:
      LOGSPOUT: ignore
      ROUTE_URIS: udp://mysyslogserver:514
      SYSLOG_TAG: '{{ index .Container.Config.Labels "io.rancher.project_service.name"
        }}[{{ index .Container.Config.Labels "io.rancher.stack_service.name" }}]'
      SYSLOG_HOSTNAME: '{{ index .Container.Config.Labels "io.rancher.container.name"
        }}'
    stdin_open: true
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    tty: true
    ports:
    - 8086:80/tcp
    labels:
      io.rancher.scheduler.global: 'true'
      io.rancher.container.hostname_override: container_name

But SYSLOG_TAG or SYSLOG_HOSTNAME don't change anything...

[desprit]

@sgrunt91

Hi!

Check this section: https://github.com/gliderlabs/logspout#mixed-json--generic

You can do something like that:

environment:
  - RAW_FORMAT={"container":"{{.Container.Name}}","message":{{toJSON .Data}}}\n

If you are using logstash don't forget to use json codec:

input { syslog { port => PORT codec => json } }