LOGS_RECEIVER_URL behaviors

[dac388]

I'm trying to use logagent (in docker swarm mode) to send logs to sematext, and also to multiple indicies in a local ELK stack.

We're building from sematext/logagent:3.0.24.

When I start the logagent with these variables: LOGS_TOKEN=logsalias LOGS_RECEIVER_URL="our.internal.url"

I can get a service's logs (say, its nginx) to sematext by starting that service with: LOGS_TOKEN=our_app_token LOGS_RECEIVER_URL="https://logsene-receiver.sematext.com:443/our_app_token"

great!

Unfortunately, if I try to send those logs to a local index other than the one with which logagent was started, I don't get logs.

eg for nginx service LOGS_TOKEN=nginxalias LOGS_RECEIVER_URL="our.internal.url/nginxalias"

If I change the logagent environment variables to match the nginx service variables, I do get logs (ie the index works).

Is there some way I can use these variables to push every service's logs to a unique index with just one logagent service? Thanks!

[megastef]

Do you use Docker or Kubernetes?

I would try to remove "LOGS_TOKEN" token when you use a different service than Sematext. I think you can specify multiple URLs for your Nginx container in LOGS_RECEIVER_URL, separated by comma ,. I think the URL can container the index name.

Please let me know if this helps.

[dac388]

Docker swarm mode within Docker Datacenter. I've tried every combination of LOGS_TOKEN, LOGS_RECEIVER_URL (both on, one on the other off, and the token in the url and the token not in the url). Logagent only ignores the token that it was launched with if you also change the LOGS_RECEIVER_URL.

[otisg]

If I understand correctly, @dac388, what you are saying is that you would like to have a single instance of Logagent:

• use receiver and token settings (from a config file) to send some logs to Sematext
• use another receiver and token/index settings (from the env vars, not config file) to send some logs to a local Elasticsearch

Is this correct?

[adnanrahic]

Hey @dac388 !

I've made some edits to the Logagent run script that will allow you to specify multiple outputs for both Sematext Logs and Elasticsearch.

Can you please try using the sematext/logagent:dev image to test it out. Here are two gists that show how to configure both the Docker Stack config file and the Logagent config file.

• Docker Stack config
• Logagent config

What I added is an option to override the LOGS_TOKEN env var by using values from the Logagent config file. You need to add this env var in your Docker Stack config file in the Logagent service.

PS: Keep both the Docker Stack config and the Logagent config in the same directory.

st-logagent: 
    image: 'sematext/logagent:dev' 
    environment: 
      - LA_CONFIG=/etc/sematext/logagent.conf
      - LA_CONFIG_OVERRIDE=true
    configs:
      - source: logagent_config
        target: /etc/sematext/logagent.conf
...

configs:
  logagent_config:
    file: ./logagent.yml

Let me know if this worked for you and I can publish a new version of the agent with this fix. :ok_hand:

If it doesn't help, hit me up and I can help you configure multiple agents to ship to different locations. :smile:

[otisg]

Closing this because you confirmed via email this is fixed, @dac388.