gelf

README

Graylog GELF Module for Logspout

This module allows Logspout to send Docker logs in the GELF format to Graylog via UDP.

Why

Micha Hausler did an initial module for Logspout to output in Gelf format, but the datamodel he chose was based on gelf ideas. This version of the module outputs in the same format as the docker gelf logger.

The dis-advantange to using the docker-gelf logger is the loss of the local docker log (e.g. docker logs ). By using LogSpout to effectively "tail" the log, this creates an additional copy of the log sent in Gelf Format.

Personally i'm using this to output to LogStash for storage in ElasticSearch, but I wanted the ability to flip docker containers between "Json-File" and "Gelf" and not have the log entries stored in different formats. I considered a simple LogStash filter but there were some additional fields missing which caused me to fork the project and decided I didn't want the additional overhead of a filter in logstash when it could be done in GO.

Other changed included reformatting the time into 3339 format, gathering the command arguments

Build

To build, you'll need to fork Logspout, add the following code to modules.go

_ "github.com/rickalm/logspout-gelf"

and run docker build -t $(whoami)/logspout:gelf

Run

docker run \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 8000:80 \
    $(whoami)/logspout:gelf \
    gelf://<graylog_host>:12201

License

MIT. See License

Documentation

Index

• func NewGelfAdapter(route *router.Route) (router.LogAdapter, error)
• type GelfAdapter
  • func (a *GelfAdapter) Stream(logstream chan *router.Message)
• type GelfMessage

Functions

func NewGelfAdapter

func NewGelfAdapter(route *router.Route) (router.LogAdapter, error)

NewGelfAdapter creates a GelfAdapter with UDP as the default transport.

Types

type GelfAdapter

type GelfAdapter struct {
	// contains filtered or unexported fields
}

GelfAdapter is an adapter that streams UDP JSON to Graylog

func (*GelfAdapter) Stream

func (a *GelfAdapter) Stream(logstream chan *router.Message)

Stream implements the router.LogAdapter interface.

type GelfMessage

type GelfMessage struct {
	Version      string `json:"version"`
	Host         string `json:"host,omitempty"`
	ShortMessage string `json:"short_message"`
	FullMessage  string `json:"message,omitempty"`
	Timestamp    int64  `json:"timestamp,omitempty"`
	Level        int    `json:"level,omitempty"`

	ImageId          string `json:"image_id,omitempty"`
	ImageName        string `json:"image_name,omitempty"`
	ContainerId      string `json:"container_id,omitempty"`
	ContainerName    string `json:"container_name,omitempty"`
	ContainerCmd     string `json:"command,omitempty"`
	ContainerCreated string `json:"created,omitempty"`
}