systemd - Structured logging to journald from within a docker container -


what best way write structured logs journald within docker container?

for example, have application writes using sd_journal_send rather change app, have tried passing through

-v /var/log/systemd/journal:/var/log/systemd/journal

it works on ubuntu 16.04 desktop, not on coreos instances app runs (which use ubuntu 16.04 base image). don't quite understand why. perhaps there better way send journal?

what limitations docker journald output logging option have? didn't appear supported apps writing more message field.

--

so have found need -v /dev/log:/dev/log

but there problem in there no association service file starts docker container. manually adding unit: servicename.service didn't solve it. , when looking @ , shipping logs service, it's associated exe not container or service. encountered these problems , how have solved them?

-- ok let me expand bit.

a c program can write systemd journal this:

#include <systemd/sd-journal.h> #include <unistd.h> #include <stdlib.h>  int main(int argc, char *argv[]) {         sd_journal_send("message=hello world!",                         "message_id=52fb62f99e2c49d89cfbf9d6de5e3555",                         "priority=5",                         "home=%s", getenv("home"),                         "term=%s", getenv("term"),                         "page_size=%li", sysconf(_sc_pagesize),                         "n_cpus=%li", sysconf(_sc_nprocessors_onln),                         null);         return 0; }

this writes journal , adds custom fields home, term, page_size etc. when use journalbeat ship them elk stack, fields end nicely in elasticsearch , can search on them directly.

however, seems docker, takes stdout of apps, , feeds journald few fields adds itself. e.g. container_id.

when using programs inside docker container , running them service file creates slight problem.

1) have pass through directories , device files write sd_journal_send.

2) if start container systemd .service file , expect use journalctl -u servicename , see messages, log messages aren't seen because went journal different route , don't associated service ran them.

3) can add arbitary fields/tags using docker's journald logging driver, fixed, 1 time additions appear on every message sent , unchanging. not dynamic fields want c code above.

essentially, journald log driver insuffient in case.

any suggestions on how both link service name journalctl -u shows log messages sd_journal_send? fix then.

-- i've found solution. i'll put answer below in case others interested in how i've solved it.

the eventual solution turned out simple.

i switched writing messages pure json. journalctl -u works , shows message field containing json data.

i used journalbeat send logstash.

to logstash.conf added:

filter {   json {     source => "message"   } }

what expands json data message field separate fields @ top level before sending them elasticsearch.

details json filter logstash can found here


Comments

Post a Comment

Popular posts from this blog

android - InAppBilling registering BroadcastReceiver in AndroidManifest -

i'm implementing inapp billing in android app. works well, however, i'm trying decouple broadcast receiver activity manifest. suggestion in android's trivialdrive sample: // important: dynamically register broadcast messages updated purchases. // register receiver here instead of <receiver> in manifest // because call getpurchases() @ startup, therefore can ignore // broadcasts sent while app isn't running. // note: registering listener in activity bad idea, done here // because sample. regardless, receiver must registered after // iabhelper setup, before first call getpurchases(). currently there's class extends broadcastreceiver : public class iabbroadcastreceiver extends broadcastreceiver { /** * intent action receiver should filter for. */ public static final string action = "com.android.vending.billing.purchases_updated"; private final iabbroadcastlistener mlistener; public iabbroadcastreceiver(iabbroadcastlistener listener) { m...
Read more

python Tkinter Capturing keyboard events save as one single string -

is possible store keyboard events 1 string? code below stores 1 char , prints it. card reader or bar code reader, contains collection of character/ string not 1 character @ time. goal save char pressed text variable. from tkinter import * root = tk() def key(event): text= event.char text+= event.char print ("pressed", text) def callback(event): frame.focus_set() print ("clicked at", event.x, event.y) frame = frame(root, width=100, height=100) frame.bind("<key>", key) frame.bind("<button-1>", callback) frame.pack() root.mainloop() currently, creating text variable , everytime key() function gets called, , text stores last character typed. you can define text module level variable , , use module level text inside key function - text = '' def key(event): global text text+= event.char print("pressed", text)
Read more

sql server - Why does Linq-to-SQL add unnecessary COUNT()? -

here tables: create table customer ( cid int primary key, name varchar(32) ) create table ord ( oid int primary key, cid int foreign key references customer, address varchar(20) ) here's linq-to-sql statement: var aaa = c in db.customer select new { c, o = c.ord.tolist() }; and here's inexplicable query generated linq-to-sql: select [t0].[cid] [cid], [t0].[name] [name], [t1].[oid] [oid], [t1].[cid] [cid2], [t1].[address] [address], (select count(*) [dbo].[ord] [t2] [t2].[cid] = [t0].[cid]) [value] [dbo].[customer] [t0] left outer join [dbo].[ord] [t1] on [t1].[cid] = [t0].[cid] order [t0].[cid], [t1].[oid] i want understand how rid of count(*) part. it's entirely uncalled for! linq needs count(*) in order determine number of entries returned o = c.ord.tolist() .
Read more