How to ingest Nginx running in a Docker container logs to Splunk?

[tomharris]

Nginx container runs in Docker container on an Amazon EC2 instance. We're soon going to setup Docker Enterprise edition in AWS account and would like to enable Nginx service running in Docker container logs to Splunk server. What is the best approach to do this and is it possible to customise the logs before forwarding to the Indexer.

[outcoldman]

Our company is offering solutions for containerized environments (https://www.outcoldsolutions.com) including Docker, OpenShift, Kubernetes (Linux and Windows containers).
We forward logs and collect metrics. You can take a look at the overview of our application at https://splunkbase.splunk.com/app/3723/
If you are using ECS on AWS - you can also take a look at our manual https://www.outcoldsolutions.com/blog/2018-03-15-monitoring-aws-ecs-in-splunk/

Nginx logs are pretty easy to collect and manage them because they have a very straightforward format. You will need to just setup search time field extraction.