topic Re: Feed the logs from AWS Fargate Docker containers in Splunk Dev

Feed the logs from AWS Fargate Docker containers

SunilGovindanku — Mon, 13 Aug 2018 17:57:58 GMT

I am looking for a way to send the logs from AWS Fargate Docker containers to Splunk. The EC2 Docker containers support the Splunk log driver but fargate ones don't. What is the best way to accomplish this?

Re: Feed the logs from AWS Fargate Docker containers

tagrawal — Fri, 14 Dec 2018 11:27:57 GMT

Just wondering, Is this a question which can be answered by Splunk or FARGATE team. IMO this is something which FARGATE team should provide support.

Re: Feed the logs from AWS Fargate Docker containers

inventsekar — Fri, 14 Dec 2018 11:58:30 GMT

maybe check this:
https://www.splunk.com/blog/2016/07/13/docker-amazon-ecs-splunk-how-they-now-all-seamlessly-work-together.html

or, check some other docker apps
https://splunkbase.splunk.com/apps/#/search/Docker

try to install on dev/test environment and maybe you need to fight a lot of configurations

Re: Feed the logs from AWS Fargate Docker containers

tagrawal — Fri, 14 Dec 2018 12:04:49 GMT

Thanks Sekar, I have myself use HEC in project but currently the issue is the logs need to be sent to Cloudwatch and then pushed to Splunk via HEC SPlunk. So one have to manage another log store plus lambda unnecessarily. AWS doc has a splunklogs driver but I think it is not enabled for FARGATE.
see link https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html

Re: Feed the logs from AWS Fargate Docker containers

ilyaresh — Mon, 27 May 2019 22:22:41 GMT

AWS Fargate PV1.3 now supports the Splunk log driver
https://aws.amazon.com/about-aws/whats-new/2019/05/aws-fargate-pv1-3-now-supports-the-splunk-log-driver/