Elasticsearch provides centralized storage and search for container logs. Fluentd collects and processes Docker output, then forwards records to Elasticsearch, where metadata such as container names supports filtering and identification. section 19.3
A practical Elasticsearch logging workflow connects:
- Docker containers to Fluentd through Docker’s Fluentd logging driver. section 19.3
- Fluentd to Elasticsearch for document storage, using indexes as searchable document collections. section 19.3
- Elasticsearch to Kibana, which provides a search interface for exploring collected logs. section 19.3
Run an EFK logging stack
Start the Docker Compose logging stack, run a container with the Fluentd driver, then open Kibana at http://localhost:5601/app/discover. Create a data view named logs with the fluentd* index pattern and @timestamp as its timestamp field. section 19.3
cd ch19/exercises/fluentd # run Fluentd publishing the standard port and using a config file: docker run -d -p 24224:24224 ` --name fluentd -v "$(pwd)/conf:/fluentd/etc" ` -e FLUENTD_CONF=stdout.conf ` diamol/fluentd:2e # now run a timecheck container set to use Docker's Fluentd log driver: docker run -d --log-driver=fluentd ` --name timecheck5 ` diamol/ch19-timecheck:2e-v3 # check the timecheck container logs: docker logs timecheck5 # and check the Fluentd container logs: docker logs --tail 1 fluentd
Run Fluentd, attach a timecheck container to its logging driver, and inspect the resulting container and collector output. section 19.3
