This repo is a simple bit of pre-canned config and extension of the official Logstash container. The intent is to use Logstash in a container as a client deployment option (vs installing it natively), with the following focuses:
- Give a pre-defined syslog input, exposed on UDP 5514 of the host
- Give a couple of examples of how to use custom config via a Dockerfile or via
docker-compose
There are a two primary usage options for this repo:
- Logstash client deployment via Docker Hub-hosted image
- Logstash client deployment via custom Docker image, with your baked-in configuration
There is a pre-built Docker image - based on the Dockerfile in this repo - hosted as ccfoss/logstash-syslog-proxy. The container needs to be able to resolve the host "elasticsearch," which you can do by using the add-host
option in your docker run
command.
For example, if your Elasticsearch endpoint's IP address was 10.2.3.4, you would run the container like so: docker run --name logstash_agent --add-host=elasticsearch:10.2.3.4 -p 5514:5514/udp ccfoss/logstash-syslog-proxy
.
Logstash will run with the following config:
- Listens on UDP 5514 for syslog messages (pro-tip: you can test via netcat (
nc
) like so:nc -w0 -u 127.0.0.1 5514 <<< "pickles"
) - Ships any logging to the ElasticSearch instance
If you want to have the same Logstash config on all clients, you might find it simpler to just create new Docker images with the required configuration baked right in. This means you do not have to ship the configuration around with the Dockerfile. It also means you can update the configuration by:
- Updating the Logstash configuration in ./config/logstash/conf.d
- Using
docker build
to update the image, followed bydocker push
to push the images - Stop, remove, and re-deploy the container using the latest image
This can change your Logstash upgrades and/or config changes to a single-line command: docker stop logstash_agent; docker rm logstash_agent; docker pull myrepo/my-logstash-client:latest; docker run --name logstash_agent <your_repo/image_name>
The build/push process goes like this:
- Make any changes you wish to the configuration in ./config/logstash/conf.d directory.
- Once done with config changes, run
docker build -t <your_repo/image_name> .
- Optionally, test your image by running it
docker run -it --rm <your_repo/image_name>
- Once satisfied, upload your image by running
docker push <your_repo/image_name>
.
From there, you can run the docker stop/rm/pull/run
one-liner listed above.