The EFK stack centralizes container logging with three cooperating components: Fluentd collects and processes logs, Elasticsearch stores them as searchable documents, and Kibana provides exploration and visualization. Applications should write logs to stdout so the platform can collect, enrich, filter, and store them without coupling each application to one logging backend. section 19.3 section 19.5
A practical container logging flow looks like this:
- Let Fluentd collect entries, add useful metadata such as component tags, and forward them to Elasticsearch. section 19.3
- Store each entry as a document in Elasticsearch indexes, commonly using a daily collection such as fluentd-{date}. section 19.3
- Use Kibana Discover to search text, filter by date or fields, inspect individual entries, and build log-count dashboards. section 19.3
Run a minimal logging path
Start Fluentd with its configuration, then launch a timecheck container using the Fluentd log driver. Generate application traffic and inspect the resulting documents in Kibana. For a multi-container application, assign tags such as gallery.access-log and gallery.image-gallery so Kibana can isolate logs by component instead of relying on container names or IDs.
The same pattern works beyond a single machine: Fluentd can run on each cluster node and forward collected logs to an Elasticsearch cluster. Although applications can write directly to Elasticsearch, keeping collection outside the application preserves the option to replace Elasticsearch with another backend such as Graylog or Loki. section 19.5
