在logstash中使用docker GELF驱动程序env /标签 [英] Using docker GELF driver env/labels in logstash

问题描述

Docker GELF日志驱动程序允许 env 和标签 log-opts：

gelf日志记录驱动程序支持标签和env选项。它在额外字段中添加了另外的键，前缀为下划线（_）（ ref ）

我想在我的索引名称中使用这个弹性搜索输出，但我无法弄清楚我可以如何访问这些值，或者说额外的字段。

假设我有这些选项运行一个容器，

  docker run -it \ 
 --log-driver gelf \ 
 --log-opt gelf-address = udp：//127.0.0.1：12201 \ 
 --log-opt tag = some-app \ 
 --log-opt env = staging \ 
 --log-opt labels = staging \ 
 ubuntu：16.04 / bin / bash -c'echo Hello World'
  

我想使用我在logstash配置中传递的 env 值：

 输入{
 gelf {} 
} 
 
输出{
 elasticsearch {
 hosts => [http://127.0.0.1:9200] 
 index => logstash  - ％{env-value-here}  - ％{tag}  - ％{+ YYYY.MM.dd}
} 
} 
  pre> 
 
 
关于使用Graylog的env /标签似乎还有一个问题： Docker GELF驱动程序env选项 
解决方案
阅读添加此选项的PR后，我意识到我误解了它应该如何工作。
 
 
 
   -  log-opt labels = a，b，c （与env相同）定义要包含在GELF事件中的键。值分别从docker标签和环境变量中检索。
 
 
 
   -  log-opt labels = foo --label foo = bar 将包含 foo：bar 。
 
Docker GELF log driver allows env and labels log-opts:

  
The labels and env options are supported by the gelf logging driver. It adds additional key on the extra fields, prefixed by an underscore (_) (ref)
I want to use this in my index name for elasticsearch output but I couldn't figure out how I can access these value or said extra fields.

Assuming that I have these options running a container,
docker run -it \
  --log-driver gelf \
  --log-opt gelf-address=udp://127.0.0.1:12201 \
  --log-opt tag=some-app \
  --log-opt env=staging \
  --log-opt labels=staging \
  ubuntu:16.04 /bin/bash -c 'echo Hello World'
I'd like to use the env value that I passed in my logstash config as such:
input {
  gelf { }
}

output {
  elasticsearch {
    hosts => ["http://127.0.0.1:9200"]
    index => "logstash-%{env-value-here}-%{tag}-%{+YYYY.MM.dd}"
  }
}
There seems to be another question about env/labels with Graylog: Docker GELF driver env option
解决方案
After reading the PR that added this option, I realised that I misunderstood how it was supposed to work.

--log-opt labels=a,b,c (same with env) define keys to include in the GELF event. The values are actually retrieved from docker labels and environment variables respectively.

--log-opt labels=foo --label foo=bar will include foo: bar in the event.

                        
这篇关于在logstash中使用docker GELF驱动程序env /标签的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！