Skip to content

Commit 37e470d

Browse files
authored
Pretty print code blocks
1 parent 8052583 commit 37e470d

File tree

1 file changed

+90
-86
lines changed

1 file changed

+90
-86
lines changed

README.md

Lines changed: 90 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -37,20 +37,19 @@ There are multiple ways to install Splunk Connect for Docker, Splunk recommends
3737

3838
### Install the Plugin from Docker Store
3939

40-
1. Pull the plugin from docker hub.
40+
1. Pull the plugin from docker hub
4141
```
42-
$ docker plugin install splunk/docker-logging-plugin --alias splunk-logging-plugin
42+
$ docker plugin install splunk/docker-logging-plugin:latest --alias splunk-logging-plugin
4343
```
4444
2. Enable the plugin if needed:
4545
```
46-
$ docker plugin enable splunk-logging-plugin:latest
46+
$ docker plugin enable splunk-logging-plugin
4747
```
4848
### Install the plugin from the tar file
4949

5050
1. Clone the repository and check out release branch
5151
```
5252
$ git clone https://github.com/splunk/docker-logging-plugin.git
53-
$ git checkout release/2.0.0
5453
```
5554
2. Create the plugin package
5655
```
@@ -85,20 +84,20 @@ https://docs.docker.com/config/containers/logging/configure/#configure-the-deliv
8584
## Examples
8685

8786
This sample <addr>daemon.json</addr> command configures Splunk Connect for Docker for all containers on the docker engine. Splunk Software recommends that when working in a production environment, you pass your HEC token through <addr>daemon.json</addr> as opposed to the command line.
88-
89-
{
90-
"log-driver": "splunk-logging-plugin",
91-
"log-opts": {
92-
"splunk-url": "<splunk_hec_endpoint>",
93-
"splunk-token": "<splunk-hec-token>",
94-
"splunk-insecureskipverify": "true"
95-
}
96-
}
97-
87+
```
88+
{
89+
"log-driver": "splunk-logging-plugin",
90+
"log-opts": {
91+
"splunk-url": "<splunk_hec_endpoint>",
92+
"splunk-token": "<splunk-hec-token>",
93+
"splunk-insecureskipverify": "true"
94+
}
95+
}
96+
```
9897
This sample command configures Splunk Connect for Docker for a single container.
99-
100-
$ docker run --log-driver=splunk-logging-plugin --log-opt splunk-url=<splunk_hec_endpoint> --log-opt splunk-token=<splunk-hec_token> --log-opt splunk-insecureskipverify=true -d <docker_image>
101-
98+
```
99+
$ docker run --log-driver=splunk-logging-plugin --log-opt splunk-url=<splunk_hec_endpoint> --log-opt splunk-token=<splunk-hec_token> --log-opt splunk-insecureskipverify=true -d <docker_image>
100+
```
102101
## Step 4: Set Configuration variables
103102

104103
Use the configuration variables to configure the behaviors and rules for Splunk Connect for Docker. For example you can confiugre your certificate security or how messages are formatted and distributed. Note the following:
@@ -111,19 +110,19 @@ Use the configuration variables to configure the behaviors and rules for Splunk
111110
The following is an example of the logging options specified for the Splunk Enterprise instance. In this example:
112111

113112
The path to the root certificate and Common Name is specified using an HTTPS scheme to be used for verification.
114-
115-
$ docker run --log-driver=splunk-logging-plugin\
116-
--log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 \
117-
--log-opt splunk-url=https://splunkhost:8088 \
118-
--log-opt splunk-capath=/path/to/cert/cacert.pem \
119-
--log-opt splunk-caname=SplunkServerDefaultCert \
120-
--log-opt tag="{{.Name}}/{{.FullID}}" \
121-
--log-opt labels=location \
122-
--log-opt env=TEST \
123-
--env "TEST=false" \
124-
--label location=west \
125-
<docker_image>
126-
113+
```
114+
$ docker run --log-driver=splunk-logging-plugin\
115+
--log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 \
116+
--log-opt splunk-url=https://splunkhost:8088 \
117+
--log-opt splunk-capath=/path/to/cert/cacert.pem \
118+
--log-opt splunk-caname=SplunkServerDefaultCert \
119+
--log-opt tag="{{.Name}}/{{.FullID}}" \
120+
--log-opt labels=location \
121+
--log-opt env=TEST \
122+
--env "TEST=false" \
123+
--label location=west \
124+
<docker_image>
125+
```
127126
### Required Variables
128127

129128
Variable | Description
@@ -173,57 +172,62 @@ There are three logging plug-in messaging formats set under the optional variabl
173172
* raw
174173

175174
The default format is inline, where each log message is embedded as a string and is assigned to "line" field. For example:
176-
177-
{
178-
"attrs": {
179-
"env1": "val1",
180-
"label1": "label1"
181-
},
182-
"tag": "MyImage/MyContainer",
183-
"source": "stdout",
184-
"line": "my message"
185-
}
186-
{
187-
"attrs": {
188-
"env1": "val1",
189-
"label1": "label1"
190-
},
191-
"tag": "MyImage/MyContainer",
192-
"source": "stdout",
193-
"line": "{\"foo\": \"bar\"}" //though this is a string that can be marshaled to json, it is still treated as a string
194-
}
195-
175+
```
176+
// Example #1
177+
{
178+
"attrs": {
179+
"env1": "val1",
180+
"label1": "label1"
181+
},
182+
"tag": "MyImage/MyContainer",
183+
"source": "stdout",
184+
"line": "my message"
185+
}
186+
187+
// Example #2
188+
{
189+
"attrs": {
190+
"env1": "val1",
191+
"label1": "label1"
192+
},
193+
"tag": "MyImage/MyContainer",
194+
"source": "stdout",
195+
"line": "{\"foo\": \"bar\"}"
196+
}
197+
```
196198
When messages are JSON objects, you may want to embed them in the message sent to Splunk.
197199

198200
To format messages as json objects, set --log-opt splunk-format=json. The plug-in will try to parse every line as a JSON object and embed the json object to "line" field. If it cannot parse the message, it is sent inline. For example:
199-
200-
{
201-
"attrs": {
202-
"env1": "val1",
203-
"label1": "label1"
204-
},
205-
"tag": "MyImage/MyContainer",
206-
"source": "stdout",
207-
"line": "my message" //fall back to a string
208-
}
209-
{
210-
"attrs": {
211-
"env1": "val1",
212-
"label1": "label1"
213-
},
214-
"tag": "MyImage/MyContainer",
215-
"source": "stdout",
216-
"line": {
217-
"foo": "bar"
218-
}
219-
}
220-
201+
```
202+
//Example #1
203+
{
204+
"attrs": {
205+
"env1": "val1",
206+
"label1": "label1"
207+
},
208+
"tag": "MyImage/MyContainer",
209+
"source": "stdout",
210+
"line": "my message"
211+
}
212+
213+
//Example #2
214+
{
215+
"attrs": {
216+
"env1": "val1",
217+
"label1": "label1"
218+
},
219+
"tag": "MyImage/MyContainer",
220+
"source": "stdout",
221+
"line": {
222+
"foo": "bar"
223+
}
224+
}
225+
```
221226
If --log-opt splunk-format=raw, each message together with attributes (environment variables and labels) and tags are combined in a raw string. Attributes and tags are prefixed to the message. For example:
222-
223-
#<tag> <env=value> <label=value> <logging_messaage>
224-
MyImage/MyContainer env1=val1 label1=label1 my message
225-
MyImage/MyContainer env1=val1 label1=label1 {"foo": "bar"}
226-
227+
```
228+
MyImage/MyContainer env1=val1 label1=label1 my message
229+
MyImage/MyContainer env1=val1 label1=label1 {"foo": "bar"}
230+
```
227231
# Troubleshooting
228232

229233
If your Splunk Connector for Docker does not behave as expected, use the debug functionality and then refer to the following tips included in output.
@@ -235,11 +239,11 @@ Plugin logs can be found as docker daemon log. To enable debug mode, export envi
235239
## Use the debugger to check your debug the Splunk HEC connection
236240

237241
Check HEC endpoint accessibility Docker environment. If the endpoint cannot be reached, debug logs are not sent to Splunk, or the logs or will buffer and drop as they roll off the buffer.
238-
239-
Test HEC endpoint is accessible
240-
$ curl -k https://<ip_address>:8088/services/collector/health
241-
{"text":"HEC is healthy","code":200}
242-
242+
```
243+
Test HEC endpoint is accessible
244+
$ curl -k https://<ip_address>:8088/services/collector/health
245+
{"text":"HEC is healthy","code":200}
246+
```
243247
## Check your HEC configuration for clusters
244248

245249
If you are using an Indexer Cluster, the current plugin accepts a single splunk-url value. We recommend that you configure a load balancer in front of your Indexer tier. Make sure the load balancer can successfully tunnel the HEC requests to the indexer tier. If HEC is configured in an Indexer Cluster environment, all indexers should have same HEC token configured. See http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/UsetheHTTPEventCollector.
@@ -253,10 +257,10 @@ If you ae using a heavy forwarder to preprocess the events (e.g: funnel multiple
253257
Stdout of a plugin is redirected to Docker logs. Such entries have a plugin=<ID> suffix.
254258

255259
To find out the plugin ID of Splunk Connect for Docker, use the command below and look for Splunk Logging Plugin entry.
256-
257-
# list all the plugins
258-
$ docker plugin ls
259-
260+
```
261+
# list all the plugins
262+
$ docker plugin ls
263+
```
260264
Depending on your system, location of Docker daemon logging may vary. Refer to Docker documentation for Docker daemon log location for your specific platform. Here are a few examples:
261265

262266
* Ubuntu (old using upstart ) - /var/logging/upstart/docker.logging

0 commit comments

Comments
 (0)