search

micahhausler / logspout-gelf

Logspout Adapter for Graylog's GELF
MIT License
28 stars 61 forks source link

Name of metadata fields #1

Open SR-G opened 8 years ago

SR-G commented 8 years ago

Hi. Everything works fine for me (thanks for your work), just a little thing.

When using "--log-driver=gelf --log-opt gelf-address=udp://localhost:12201" on some containers, the metadata are stored in fields like "container_name". When using logspout-gelf, metadata fields are named like "docker.image" (as stated in the README.md).

Is there any simple way to have the same field in both situations ? (at first glance it seems that it is only defined in the .go module) (and i don't know at this time exactly how to rebuild the whole logspout-gelf container)

micahhausler commented 8 years ago

I'm not quite sure what metadata field container_name you're talking about, can you maybe give a more complete example?

Container attributes are prefixed with an underscore to comply with the GELF 1.1 spec, and the module adds the container image, name, and container id to the GELF message.

If you'd like to add (or rename) additional parameters, you are welcome to fork this or use it as a starting point. All the available docker attributes are available from github.com/fsouza/go-dockerclient. It's pretty easy to build logspout with your own module, see my README#build, and the logspout docs.

rickalm commented 8 years ago

Micah,

What SR-G was asking about was a version that would output the same fields with the same names if you were to use the Docker Gelf Driver. The reasons for wanting that is interchangeability between using the "native" support or logspout for gather the logs without having to change any dashboards.

I realize some of the work can be done using a logstash filter (If thats where the data is being routed) but there were also a few fields missing from the output.

SR-G,

I've forked Micah's repo and created one that output's data closely formatted as Docker's Gelf support. It's https://github.com/rickalm/logspout-gelf .

The only field I have not found a good way to support is the hostname field. When the Docker Daemon sends the logs it arrives from the Docker Host identity but because if you run logspout in a docker container (ala gliderlabs/logspout) the "hostname" is the container name and not the host name.

I've been using the docker build to compile the binary then using docker copy to extract the logspout binary and deploy that to my target hosts. It's a cheap CI without having to build much tooling around the compile step.

Rick