Getting Data In

What is the best practice for getting logs from a Docker container into Splunk?

jtiner
New Member

So, I have about a thousand ways to index logs from a Docker container, but what I'm looking for is some kind of best practice for getting logs from a docker container into splunk.

None of the solutions I've come up with are elegant and I don't really like them. Anyone out there using Docker and Splunk? If so, how are you accomplishing it? mounting a volume for the container to write logs and then using Splunk on the Docker host? Writing all logs to stdout and forwarding that to Wyslog server that's running a Splunk Forwarder? Running Splunk forwarder inside the container? Something else?

Help me find a best practice way to do this!

0 Karma

dart
Splunk Employee
Splunk Employee

This pull request was merged into Docker (https://github.com/docker/docker/pull/16488) to add a log driver based on the HTTP Event Collector.

I'd use either this method or set up logging to the HTTP Event collector direct from your application - we have integrated this with Java and .NET and in beta for Javascript

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...