search

gliderlabs / logspout

Log routing for Docker container logs
MIT License
4.65k stars 679 forks source link

No logs appearing in Papertrail #306

Open cjohansen opened 7 years ago

cjohansen commented 7 years ago

I'm trying to run logspout to put my logs in Papertrail without much luck. Here's the output of docker logs logspout:

# logspout v3.1 by gliderlabs
# adapters: udp tls raw syslog tcp
# options : persist:/mnt/routes
# jobs    : http[logs,routes]:80 pump routes
# routes  :
#   ADAPTER ADDRESS             CONTAINERS              SOURCES OPTIONS
#   syslog+tls  logs.papertrailapp.com:xxxx myapp1,myapp2       map[]

Which looks right to me. Tailing the log locally over http (e.g. curl http://localhost:8000/logs) shows me the relevant log messages. However, with the 3.2.1 container, all I could see in Papertrail was a whole bunch of these:

May 24 13:39:03 my-hostname dockerd:  time="2017-05-24T11:39:03.246506810Z" level=error msg="Error streaming logs: invalid character '\\x00' looking for beginning of value"

Looks like the same thing that was reported https://github.com/gliderlabs/logspout/issues/246#issuecomment-286284186, so I tried the recommendation there, running v3.1 instead. With 3.1 the error goes away, but I still do not see a single log statement in Papertrail (the http endpoint is still logging messages as expected). Am I holding it wrong?

cjohansen commented 7 years ago

The logspout container doesn't have any more logs. Where can I find some information about logspout's attempts to send logs to papertrail?

cjohansen commented 7 years ago

I assumed that all the filters supported a comma-separated list of containers. Turns out this is not the case, so the above filter actually filters on container with name "myapp1,myapp2", instead of the two intended containers. Worked around this with labels instead. I would suggest making this limitation on filter.name explicit in the Readme (or supporting a comma-separated list of names for filter.name).

michaelshobbs commented 7 years ago

I agree it would be preferable to support a comma separated list. I haven't been in that part of the code yet but I'd be interested to see a PR for this change.

mjablecnik commented 6 years ago

@cjohansen how did you started the logspout? When I run it as: 

docker run --restart=always --name logspout --hostname logspout -d -v=/var/run/docker.sock:/var/run/docker.sock gliderlabs/logspout:master syslog://logs6.papertrailapp.com:$PORT

works for me.