| .. | ||
| conf | ||
| Dockerfile | ||
| README.md | ||
This image bundles the latest (1.5.x) version of Logstash with the ability to groom its own Elasticsearch indices.
Basic Usage
To start a Logstash container, setup a directory on your host with one or more Logstash
pipeline configurations files, called $HOST_CONF here, and run
docker run -d -v $HOST_CONF:/conf itzg/logstash
Accessing host logs
Logstash is much more useful when it is actually processing...logs. Logs inside the container
are non-existent, but you can attach the host machine's /var/log directory via the container's
/logs volume:
docker run ... -v /var/log:/logs ...
Keep in mind you will need to configure file inputs with a base path of /logs, such as
file {
path => ['/logs/syslog']
type => 'syslog'
}
Receiving input from collectd
To allow for incoming collectd content, UDP port 25826 is exposed and can be mapped onto the host using:
docker run ... -p 25826:25826/udp
Regardless of the host port, be sure to configure the logstash input to bind at port 25826, such
as
udp {
port => 25826
codec => collectd { }
buffer_size => 1452
}