search

splunk / docker-logging-plugin

Splunk Connect for Docker is a Docker logging plugin that allows docker containers to send their logs directly to Splunk Enterprise or a Splunk Cloud deployment.
Apache License 2.0
65 stars 25 forks source link

splunk-driver vs logging-plugin #2

Closed parthiv-crest closed 6 years ago

parthiv-crest commented 6 years ago

We are trying to get the container logs into Splunk so we have installed the plugin as per guideline. We have able to send the stout logs to Splunk.

But our problem is how to identify that the docker is using Splunk-driver, or this plugin(docker-logging-plugin) to send the data.? As we changed the code of driver.go file and rebuild the plugin but we could not find any impact. So we believe that after installing this plugin docker is still using the Splunk-driver.

Please share your thoughts.

bbourbie commented 6 years ago

Hello @parthiv-crest, Very sorry for the late answer, I just saw your question...

Yes, there's a driver inside moby/moby (docker) that is also named splunk and it's somewhat difficult to know which one is the driver and which one is the plugin. The plugin is very similar than the driver, I think that Docker is planning on deprecating drivers very soon and we try to keep the interface the same.

I sightly changed the code (the plugin name) and it should be more obvious now.

I would download/update the code source by running the command:

git clone git@github.com:splunk/docker-logging-plugin.git

Then, I would create and enable the plugin by running the command

make && make enable

You should be able to see the plugin installed and enabled by running the command:

docker plugin ls

The plugin is called splunk-log-plugin.

Then run the docker command:

docker run --log-driver=splunk-log-plugin \
             --log-opt splunk-url=https://your-splunkhost:8088 \
             --log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 \
             --log-opt splunk-capath=/path/to/cert/cacert.pem \
             --log-opt splunk-caname=SplunkServerDefaultCert \
             --log-opt tag="{{.Name}}/{{.FullID}}" \
             --log-opt labels=location \
             --log-opt env=TEST \
             --env "TEST=false" \
             --label location=west \
             -it ubuntu bash

To be sure, it is really the plugin and not the driver, the plugin has some reading capabilities on i.e. the command: 

 docker logs your-docker-container

should return some data, the driver should be returning an error.