Docker container logs via fleet on Windows Docker Host using WSL2

[Ian_Core]

Hi All,

I am trying to ingest docker container logs using fleet.

My agent policy has docker and docker metrics are successfully being sent using the

npipe:////./pipe/docker_engine

configuration for host.

The docs suggest I should be able to connect with the Unix socket but we had no luck with that, hence the named pipe.

Logs section is ticked, there are no logs coming through from the containers.

As mentioned Docker desktop is using wsl2.

The configuration for log path is currently default;

/var/lib/docker/containers/${docker.container.id}/${docker.container.id}-json.log

I have tried permutations and combinations for the file path with no success.

I have also attempted to use a logstash integration using the wsl path - \\wsl.localhost\docker-desktop-data\data\docker\containers\*\*-json.log

(I can see these using the above path in file explorer)

This doesn't work either.

[Ian_Core]

So we have moved away from WSL2 and are monitoring on Windows server with native docker for windows, runninning as a service via dockerd. Again we can ingest metrics via the npipe, however the logs are not being picked up. In order to ingest the logs we are using a separate logstash integration.

We currently have the below in advanced;

C:\ProgramData\docker\containers${docker.container.id}${docker.container.id}-json.log

The logs aren't being collected.

In the logstash integration we are using;

C:\ProgramData\docker\containers**-json.log

which works but not ideal

This config doesn't work when applied to the docker integration. Any ideas?