Sending Docker container logs to ELK Stack by configuring the logging drivers - Easy Method
Docker includes multiple logging mechanisms to help you get information from running containers and services by means of logging drivers.
Each Docker daemon has a default logging driver, which each container uses unless you configure it to use a different logging driver.
You can simply get your container logs by configuring Logstash as follows and running the container whose logs are to be viewed by changing its default log driver to syslog.
#logstash.confinput { tcp { port => 5000 }}output { stdout {}}The below two commands will display the hello-world container logs in logstash.
docker run -it --rm --name=logstash -p 5000:5000 -v /path/to/logstash.conf:/usr/share/logstash/config/logstash.yml docker.elastic.co/logstash/logstash:7.14.0docker run --log-driver=syslog --log-opt syslog-address=tcp://<logstash-system-ip>:5000 hello-worldThe output of Logstash can even sent to elasticsearch by simply configuring the output section as,
elasticsearch { hosts => ["<elastic-system-ip>:9200"] }Visit https://docs.docker.com/engine/admin/logging/overview/