Getting Data In

How to ingest Nginx running in a Docker container logs to Splunk?

tomharris
New Member

Nginx container runs in Docker container on an Amazon EC2 instance. We're soon going to setup Docker Enterprise edition in AWS account and would like to enable Nginx service running in Docker container logs to Splunk server. What is the best approach to do this and is it possible to customise the logs before forwarding to the Indexer.

Tags (1)
0 Karma

outcoldman
Communicator

Our company is offering solutions for containerized environments (https://www.outcoldsolutions.com) including Docker, OpenShift, Kubernetes (Linux and Windows containers).
We forward logs and collect metrics. You can take a look at the overview of our application at https://splunkbase.splunk.com/app/3723/
If you are using ECS on AWS - you can also take a look at our manual https://www.outcoldsolutions.com/blog/2018-03-15-monitoring-aws-ecs-in-splunk/

Nginx logs are pretty easy to collect and manage them because they have a very straightforward format. You will need to just setup search time field extraction.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!