Hello,
I am using docker and I send all containers logs using logspout into a TCP input on Splunk.
Before trying to use Splunk, I was using Graylog. It was possible to extract logs from an input to send it into a specific index, based on a tag.
This is what I am trying to do with Splunk : all logs from all my containers are send in only one input and in consequence into only one index.
Is there a way to apply the same thing that I was doing using Graylog, using the web GUI mostly?
The main goal is to aggregate all logs from one container only into one dedicated index.
Thanks for your help.
... View more