When logs come from many containers, Fluentd can collect them in one place. It ingests log records, filters or enriches them, and forwards them to a destination. Docker containers can send logs through the built-in Fluentd logging driver; Fluentd can also read logs from Docker’s JSON files. section 19.3
cd ch19/exercises/fluentd # run Fluentd publishing the standard port and using a config file: docker run -d -p 24224:24224 ` --name fluentd -v "$(pwd)/conf:/fluentd/etc" ` -e FLUENTD_CONF=stdout.conf ` diamol/fluentd:2e # now run a timecheck container set to use Docker's Fluentd log driver: docker run -d --log-driver=fluentd ` --name timecheck5 ` diamol/ch19-timecheck:2e-v3 # check the timecheck container logs: docker logs timecheck5 # and check the Fluentd container logs: docker logs --tail 1 fluentd
Run Fluentd with a configuration that writes received records to stdout, then start a container with `--log-driver=fluentd`. Compare `docker logs timecheck5` with the Fluentd container’s logs to verify forwarding. Fluentd adds the source container’s ID and name to each record. section 19.3
For searchable, centralized logs, Fluentd can forward records to Elasticsearch, where Kibana provides a search interface. Application logs must first be visible as container logs: write them to stdout directly or relay them there. This keeps the destination out of application code, so the logging stack can change without reworking each app. section 19.3 section 19.5
Listing 19.4 Sending log entries to different targets based on the tag
<match gallery.access-log.**>
@type copy
<store>
@type stdout
</store>
</match>
<match gallery.**>
@type copy
<store>
@type elasticsearch
. . .
Match blocks route records by the tag set in Docker’s logging options. Here, access-log records go to Fluentd’s stdout, while other gallery records go to Elasticsearch. The configuration can also split a tag into app, service, and image fields for easier filtering in Kibana. section 19.4
Practice: configure another application
Set the Fluentd logging driver and an app–service–image tag on every component of the numbers app. Configure Fluentd to split that tag into fields, and send records from other apps to stdout as a failsafe. section 19.6
