Hi all,
Docker home user here who needs some help.
Architecture:
- Host OS: Windows 10 Pro
- Docker for Windows latest version.
- I use docker compose managed through dockstation.io
In the attached picture you can see what containers I'm running so that you can have an opinion about my usage.
(personal media server)
In the beginning I wanted a "task manager" web based look alike. That's how I discovered Telegraf, Influxdb and Grafana.
Then I wanted reverse proxy for my comfort.
Then I wanted https.
Now I want to establish a log analysis suite.
Using Portainer I observed that all the containers logs are in the below location:
/var/lib/docker/containers/containerID/container ID-json.log
So I managed to make this work with EFK. Filebeat collects the logs and exports them to Elasticsearch, Kibana allows me to take a look on them.
The only problem that I have is that the messages are 'too plain ?'
Here is my Filebeat.yml content:
filebeat.inputs:
- type: container
paths:
- '/var/lib/docker/containers/*/*.log'
processors:
- add_docker_metadata:
host: "unix:///var/run/docker.sock"
- decode_json_fields:
fields: ["message"]
target: "json"
overwrite_keys: true
output.elasticsearch:
hosts: ["elasticsearch:9200"]
indices:
- index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}
logging.json: true
logging.metrics.enabled: false
Here is how my logs look like:
InfluxDB
As you can see the structure of the logs is not the same.
Ouroboros example of a message from Kibana:
{
"_index": "filebeat-7.3.0-2019.08.22",
"_type": "_doc",
"_id": "tDOBu2wBoGS74nL1zKc8",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2019-08-22T22:45:36.101Z",
"log": {
"offset": 442,
"file": {
"path": "/var/lib/docker/containers/5305fbb22a8674f1285d853b2b742172d39a28300e424c16d8e5be761ba680f1/5305fbb22a8674f1285d853b2b742172d39a28300e424c16d8e5be761ba680f1-json.log"
}
},
"stream": "stderr",
"message": "2019-08-23 01:45:35 : INFO : dockerclient : bazarr will be updated",
"input": {
"type": "container"
},
"ecs": {
"version": "1.0.1"
},
"host": {
"name": "filebeat"
},
"agent": {
"id": "c7ec1ac4-9f54-4666-8ad9-bc2da0278b35",
"version": "7.3.0",
"type": "filebeat",
"ephemeral_id": "985e66a2-7a1f-4a2a-9a41-877f92b71e51",
"hostname": "filebeat"
},
"container": {
"id": "5305fbb22a8674f1285d853b2b742172d39a28300e424c16d8e5be761ba680f1",
"image": {
"name": "pyouroboros/ouroboros:latest"
},
"name": "ouroboros",
"labels": {
"maintainers": "dirtycajunrice,circa10a",
"com_docker_compose_config-hash": "018ff98fa04dce7af3fba51f871df995215dacc2ea57733faf4458aa5a4774ff",
"com_docker_compose_container-number": "1",
"com_docker_compose_oneoff": "False",
"com_docker_compose_project": "media-server",
"com_docker_compose_service": "ouroboros",
"com_docker_compose_version": "1.24.1"
}
}
},
"fields": {
"@timestamp": [
"2019-08-22T22:45:36.101Z"
],
"suricata.eve.timestamp": [
"2019-08-22T22:45:36.101Z"
]
},
"sort": [
1566513936101
]
}
Compared with my previous trials based on Logstash, I'm quite happy with the simplicity of the Filebeat solution.
For the moment I only have message field with log messages in Kibana, I'm assuming that the message field should be split in more fields (level etc.).
What do you think, is there a way to make all this uniform ?
here's the original tutorial that I followed to make this work.
They all follow the 
?