There's so many way to send logs to an elk... logspout, filebeat, journalbeat, etc.
But docker has a gelf log driver and logstash a gelf input. So here we are.
Here is a docker-compose to test a full elk with a container sending logs via gelf.
| // NOTE: this adds a filename and line number to winston's output | |
| // Example output: 'info (routes/index.js:34) GET 200 /index' | |
| var winston = require('winston') | |
| var path = require('path') | |
| var PROJECT_ROOT = path.join(__dirname, '..') | |
| var logger = new winston.logger({ ... }) | |
| // this allows winston to handle output from express' morgan middleware |
| [ | |
| {rabbit, [ | |
| %% snip... | |
| ]}, | |
| {rabbitmq_shovel, [ | |
| {shovels, [ | |
| {'MUTHA-SHOVELER', [ | |
| {sources, [ | |
| {broker, "amqp://"} |
| var Base64 = { | |
| characters: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" , | |
| encode: function( string ) | |
| { | |
| var characters = Base64.characters; | |
| var result = ''; | |
| var i = 0; | |
| do { |
There's so many way to send logs to an elk... logspout, filebeat, journalbeat, etc.
But docker has a gelf log driver and logstash a gelf input. So here we are.
Here is a docker-compose to test a full elk with a container sending logs via gelf.