Feed the logs from AWS Fargate Docker containers

[SunilGovindanku]

I am looking for a way to send the logs from AWS Fargate Docker containers to Splunk. The EC2 Docker containers support the Splunk log driver but fargate ones don't. What is the best way to accomplish this?

[ilyaresh]

AWS Fargate PV1.3 now supports the Splunk log driver
https://aws.amazon.com/about-aws/whats-new/2019/05/aws-fargate-pv1-3-now-supports-the-splunk-log-dri...

[inventsekar]

maybe check this:
https://www.splunk.com/blog/2016/07/13/docker-amazon-ecs-splunk-how-they-now-all-seamlessly-work-tog...

or, check some other docker apps
https://splunkbase.splunk.com/apps/#/search/Docker

try to install on dev/test environment and maybe you need to fight a lot of configurations

[tagrawal]

Thanks Sekar, I have myself use HEC in project but currently the issue is the logs need to be sent to Cloudwatch and then pushed to Splunk via HEC SPlunk. So one have to manage another log store plus lambda unnecessarily. AWS doc has a splunklogs driver but I think it is not enabled for FARGATE.
see link https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LogConfiguration.html

[tagrawal]

Just wondering, Is this a question which can be answered by Splunk or FARGATE team. IMO this is something which FARGATE team should provide support.