splunk-docker-logging-plugin sending logs to Splunk Enterprise but not storing the logs in Docker host machine

charanbr — Wed, 08 Jul 2020 10:07:14 GMT

Hi Team,

In general, when we create a Docker container, the logs of that container will be stored in the host machine path /DOCKER_PATH/docker-data/container/CONTAINER_ID/CONTAINER_ID.json. Now, we are using splunk-docker-logging-plugin, after implementing splunk-docker-logging-plugin, the logs file /DOCKER_PATH/docker-data/container/CONTAINER_ID/CONTAINER_ID.json itself is not getting created. The logs are directly pushed to Splunk server but the logs are not getting stored in the container log file(/DOCKER_PATH/docker-data/container/CONTAINER_ID/CONTAINER_ID.json) in the Docker host machine. So can you please confirm whether we can store logs in both the places - 1) Forwarding to Splunk server and 2) Storing the logs in /DOCKER_PATH/docker-data/container/CONTAINER_ID/CONTAINER_ID.json till the container is alive.

topic splunk-docker-logging-plugin sending logs to Splunk Enterprise but not storing the logs in Docker host machine in Knowledge Management

splunk-docker-logging-plugin sending logs to Splunk Enterprise but not storing the logs in Docker host machine