Getting Data In

How to ingest Nginx running in a Docker container logs to Splunk?

tomharris
New Member

Nginx container runs in Docker container on an Amazon EC2 instance. We're soon going to setup Docker Enterprise edition in AWS account and would like to enable Nginx service running in Docker container logs to Splunk server. What is the best approach to do this and is it possible to customise the logs before forwarding to the Indexer.

Tags (1)
0 Karma

outcoldman
Communicator

Our company is offering solutions for containerized environments (https://www.outcoldsolutions.com) including Docker, OpenShift, Kubernetes (Linux and Windows containers).
We forward logs and collect metrics. You can take a look at the overview of our application at https://splunkbase.splunk.com/app/3723/
If you are using ECS on AWS - you can also take a look at our manual https://www.outcoldsolutions.com/blog/2018-03-15-monitoring-aws-ecs-in-splunk/

Nginx logs are pretty easy to collect and manage them because they have a very straightforward format. You will need to just setup search time field extraction.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...