You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This sample <addr>daemon.json</addr> command configures Splunk Connect for Docker for all containers on the docker engine. Splunk Software recommends that when working in a production environment, you pass your HEC token through <addr>daemon.json</addr> as opposed to the command line.
88
-
89
-
{
90
-
"log-driver": "splunk-logging-plugin",
91
-
"log-opts": {
92
-
"splunk-url": "<splunk_hec_endpoint>",
93
-
"splunk-token": "<splunk-hec-token>",
94
-
"splunk-insecureskipverify": "true"
95
-
}
96
-
}
97
-
87
+
```
88
+
{
89
+
"log-driver": "splunk-logging-plugin",
90
+
"log-opts": {
91
+
"splunk-url": "<splunk_hec_endpoint>",
92
+
"splunk-token": "<splunk-hec-token>",
93
+
"splunk-insecureskipverify": "true"
94
+
}
95
+
}
96
+
```
98
97
This sample command configures Splunk Connect for Docker for a single container.
Use the configuration variables to configure the behaviors and rules for Splunk Connect for Docker. For example you can confiugre your certificate security or how messages are formatted and distributed. Note the following:
@@ -111,19 +110,19 @@ Use the configuration variables to configure the behaviors and rules for Splunk
111
110
The following is an example of the logging options specified for the Splunk Enterprise instance. In this example:
112
111
113
112
The path to the root certificate and Common Name is specified using an HTTPS scheme to be used for verification.
@@ -173,57 +172,62 @@ There are three logging plug-in messaging formats set under the optional variabl
173
172
* raw
174
173
175
174
The default format is inline, where each log message is embedded as a string and is assigned to "line" field. For example:
176
-
177
-
{
178
-
"attrs": {
179
-
"env1": "val1",
180
-
"label1": "label1"
181
-
},
182
-
"tag": "MyImage/MyContainer",
183
-
"source": "stdout",
184
-
"line": "my message"
185
-
}
186
-
{
187
-
"attrs": {
188
-
"env1": "val1",
189
-
"label1": "label1"
190
-
},
191
-
"tag": "MyImage/MyContainer",
192
-
"source": "stdout",
193
-
"line": "{\"foo\": \"bar\"}" //though this is a string that can be marshaled to json, it is still treated as a string
194
-
}
195
-
175
+
```
176
+
// Example #1
177
+
{
178
+
"attrs": {
179
+
"env1": "val1",
180
+
"label1": "label1"
181
+
},
182
+
"tag": "MyImage/MyContainer",
183
+
"source": "stdout",
184
+
"line": "my message"
185
+
}
186
+
187
+
// Example #2
188
+
{
189
+
"attrs": {
190
+
"env1": "val1",
191
+
"label1": "label1"
192
+
},
193
+
"tag": "MyImage/MyContainer",
194
+
"source": "stdout",
195
+
"line": "{\"foo\": \"bar\"}"
196
+
}
197
+
```
196
198
When messages are JSON objects, you may want to embed them in the message sent to Splunk.
197
199
198
200
To format messages as json objects, set --log-opt splunk-format=json. The plug-in will try to parse every line as a JSON object and embed the json object to "line" field. If it cannot parse the message, it is sent inline. For example:
199
-
200
-
{
201
-
"attrs": {
202
-
"env1": "val1",
203
-
"label1": "label1"
204
-
},
205
-
"tag": "MyImage/MyContainer",
206
-
"source": "stdout",
207
-
"line": "my message" //fall back to a string
208
-
}
209
-
{
210
-
"attrs": {
211
-
"env1": "val1",
212
-
"label1": "label1"
213
-
},
214
-
"tag": "MyImage/MyContainer",
215
-
"source": "stdout",
216
-
"line": {
217
-
"foo": "bar"
218
-
}
219
-
}
220
-
201
+
```
202
+
//Example #1
203
+
{
204
+
"attrs": {
205
+
"env1": "val1",
206
+
"label1": "label1"
207
+
},
208
+
"tag": "MyImage/MyContainer",
209
+
"source": "stdout",
210
+
"line": "my message"
211
+
}
212
+
213
+
//Example #2
214
+
{
215
+
"attrs": {
216
+
"env1": "val1",
217
+
"label1": "label1"
218
+
},
219
+
"tag": "MyImage/MyContainer",
220
+
"source": "stdout",
221
+
"line": {
222
+
"foo": "bar"
223
+
}
224
+
}
225
+
```
221
226
If --log-opt splunk-format=raw, each message together with attributes (environment variables and labels) and tags are combined in a raw string. Attributes and tags are prefixed to the message. For example:
If your Splunk Connector for Docker does not behave as expected, use the debug functionality and then refer to the following tips included in output.
@@ -235,11 +239,11 @@ Plugin logs can be found as docker daemon log. To enable debug mode, export envi
235
239
## Use the debugger to check your debug the Splunk HEC connection
236
240
237
241
Check HEC endpoint accessibility Docker environment. If the endpoint cannot be reached, debug logs are not sent to Splunk, or the logs or will buffer and drop as they roll off the buffer.
If you are using an Indexer Cluster, the current plugin accepts a single splunk-url value. We recommend that you configure a load balancer in front of your Indexer tier. Make sure the load balancer can successfully tunnel the HEC requests to the indexer tier. If HEC is configured in an Indexer Cluster environment, all indexers should have same HEC token configured. See http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/UsetheHTTPEventCollector.
@@ -253,10 +257,10 @@ If you ae using a heavy forwarder to preprocess the events (e.g: funnel multiple
253
257
Stdout of a plugin is redirected to Docker logs. Such entries have a plugin=<ID> suffix.
254
258
255
259
To find out the plugin ID of Splunk Connect for Docker, use the command below and look for Splunk Logging Plugin entry.
256
-
257
-
# list all the plugins
258
-
$ docker plugin ls
259
-
260
+
```
261
+
# list all the plugins
262
+
$ docker plugin ls
263
+
```
260
264
Depending on your system, location of Docker daemon logging may vary. Refer to Docker documentation for Docker daemon log location for your specific platform. Here are a few examples:
261
265
262
266
* Ubuntu (old using upstart ) - /var/logging/upstart/docker.logging
0 commit comments