vincit / logspout-gelf

Logspout with GELF adapter

Logspout with GELF adapter

This image contains Logspout which is compiled with GELF adapter so you can forward Docker logs in GELF format using gelf://hostname:port as the Logspout command.

Usage

Always read the official instructions first. This image should work the same way. Just use gelf as the protocol scheme.

Remember to set the hostname of the container to something meaningfull, because that gets set as the source of the GELF message.

CLI example

docker run -d --name=logspout --restart=unless-stopped -h $(hostname -f) -v /var/run/docker.sock:/var/run/docker.sock vincit/logspout-gelf gelf://my.log.server:12201

Docker Compose example

You could use this image with the following docker-compose file:

version: '2'

services:
  logspout:
    image: vincit/logspout-gelf
    hostname: my.message.source
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: gelf://my.log.server:12201
    restart: unless-stopped

Disclaimer

This image is provided as-is and only with best effort. We try to update this image with the latest Logspout stable version.

logspout-gelf's Issues

GELF message (received from <*:*>) has invalid "timestamp"

2018-01-23 14:34:54,699 WARN : org.graylog2.inputs.codecs.GelfCodec - GELF message <94044d90-004a-11e8-b29a-0242ac120004> (received from <172.18.0.1:45318>) has invalid "timestamp": 2018-01-23T14:34:54.528892092Z (type: STRING)

I am using "logspout-gelf" to send docker output to Graylog 2.4.0 and the output is being logged but this message is also being indexed by Graylog. Killing the "logstash-gelf" docker (obviously) stops this. Restarting "logstash-gelf" indexes a few of the messages then it stops until the next event is logged in any other docker container.

example container run:
docker run -d --name num_gen debian:jessie bash -c 'for i in {0..2000}; do echo $i; done'

/etc/host_hostname not used

Reading the logspout doku (see "Using Logspout in a swarm"), logspout should use /etc/host_hostname (if present) for the SYSLOG_HOSTNAME filed.

Though the file is availabe in my container instance, logspout-gelf still uses the docker-container-hostname for SYSLOG_HOSTNAME.

See also micahhausler/logspout-gelf#16

panic: runtime error: slice bounds out of range

Hey

First of all, thanks for taking the pain out of rebuilding an image :)

Container started with
$ docker run --name logspout --volume=/var/run/docker.sock:/var/run/docker.sock -h $(hostname -s) --restart=unless-stopped vincit/logspout-gelf gelf://192.168.10.206:12201

I just had a weird occurence, when logspout-gelf crashed with the following trace:

# logspout v3.2.4 by gliderlabs                                                                                    
# adapters: syslog tcp udp tls gelf raw                                                                            
# options : persist:/mnt/routes                                                                                    
# jobs    : routes http[logs,routes]:80 pump                                                                       
# routes  :                                                                                                        
#   ADAPTER     ADDRESS                 CONTAINERS      SOURCES OPTIONS                                            
#   gelf        192.168.10.206:12201                            map[]                                              
panic: runtime error: slice bounds out of range                                                                    
                                                                                                                   
goroutine 9 [running]:                                                                                             
github.com/micahhausler/logspout-gelf.GelfMessage.getExtraFields(0xc42027a300, 0xc4202b3e88, 0x1, 0x0, 0x0, 0x0)   
        /go/src/github.com/micahhausler/logspout-gelf/gelf.go:95 +0x78f                                            
github.com/micahhausler/logspout-gelf.(*GelfAdapter).Stream(0xc42005f2b0, 0xc420084540)                            
        /go/src/github.com/micahhausler/logspout-gelf/gelf.go:53 +0xc9                                             
github.com/gliderlabs/logspout/router.(*RouteManager).route(0xc420026640, 0xc4200ca370)                            
        /go/src/github.com/gliderlabs/logspout/router/routes.go:160 +0xb3                                          
github.com/gliderlabs/logspout/router.(*RouteManager).Run.func1(0xc420026640, 0xc4200ca370)                        
        /go/src/github.com/gliderlabs/logspout/router/routes.go:186 +0x35
created by github.com/gliderlabs/logspout/router.(*RouteManager).Run
        /go/src/github.com/gliderlabs/logspout/router/routes.go:185 +0xe8

I'll keep watching if it happens again. I don't know what triggered that error.

Thanks,

tcp

i can't send to tcp, i have graylog in cluster and I can't balance udp connection.
I get the following error.

[email protected] | # routes :
[email protected] | # ADAPTER ADDRESS CONTAINERS SOURCES OPTIONS
[email protected] | # multiline+gelf 172.17.70.150:12201 map[]
[email protected] | 2018/10/16 12:05:59 Graylog: write udp 172.19.0.3:34834->172.17.70.150:12201: write: connection refused
[email protected] | 2018/10/16 12:05:59 Graylog: write udp 172.19.0.3:34834->172.17.70.150:12201: write: connection refused

I tried it change udp to tcp in gelf.go, but it did not bring results.

Could you tell me how to solve my problem?

docker-compose.yml

version: '3'
services:
logspout:
build: ./
image: reg.efp:5000/logspout:gelf
volumes:
- /etc/hostname:/etc/host_hostname:ro
- /var/run/docker.sock:/var/run/docker.sock
environment:
- LOGSPOUT_MULTILINE=true
ports:
- "17000:80"
command: multiline+gelf://172.17.70.150:12201
restart: unless-stopped
deploy:
mode: global

Dockerfile

WORKDIR /go/src/github.com/gliderlabs/logspout
FROM golang:alpine as build
MAINTAINER [email protected]
LABEL maintainer "[email protected]"
ENV LOGSPOUT_VERSION=3.2.5
ENV LOGSPOUT_DOWNLOAD_SHA256=22a8f1fbce7298c16b6ab7401216d8bf4c3b7dc710889371d434a123d5d4d0a2
RUN mkdir -p /go/src
WORKDIR /go/src
VOLUME /mnt/routes
EXPOSE 80

RUN apk --no-cache add curl git gcc musl-dev
RUN curl -fSL -o logspout.tar.gz "https://github.com/gliderlabs/logspout/archive/v${LOGSPOUT_VERSION}.tar.gz"
&& echo "$LOGSPOUT_DOWNLOAD_SHA256 *logspout.tar.gz" | sha256sum -c -
&& tar -zxvf logspout.tar.gz
&& rm logspout.tar.gz
&& mkdir -p /go/src/github.com/gliderlabs/
&& mv logspout-${LOGSPOUT_VERSION} /go/src/github.com/gliderlabs/logspout

WORKDIR /go/src/github.com/gliderlabs/logspout
RUN echo 'import ( _ "github.com/morgoved/logspout-gelf-tcp-fork" )' >> /go/src/github.com/gliderlabs/logspout/modules.go
RUN go get -d -v ./...
RUN go build -v -ldflags "-X main.Version=$(cat VERSION)" -o ./bin/logspout

FROM alpine:latest
COPY --from=build /go/src/github.com/gliderlabs/logspout/bin/logspout /go/bin/logspout
ENTRYPOINT ["/go/bin/logspout"]