Splunk logging driver

Thesplunklogging driver sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud.

Usage

You can configure Docker logging to use thesplunkdriver by default or on a per-container basis.

To use thesplunkdriver as the default logging driver, set the keys log-driverandlog-optsto appropriate values in thedaemon.json configuration file and restart Docker. For example:

{
"log-driver":"splunk",
"log-opts":{
"splunk-token":"",
"splunk-url":"",
...
}
}

The daemon.json file is located in/etc/docker/on Linux hosts or C:\ProgramData\docker\config\daemon.jsonon Windows Server. For more about configuring Docker usingdaemon.json,see daemon.json.

Note

log-optsconfiguration options in thedaemon.jsonconfiguration file must be provided as strings. Boolean and numeric values (such as the value for splunk-gziporsplunk-gzip-level) must therefore be enclosed in quotes (").

To use thesplunkdriver for a specific container, use the commandline flags --log-driverandlog-optwithdocker run:

$docker run --log-driver=splunk --log-opt splunk-token=VALUE --log-opt splunk-url=VALUE...

Splunk options

The following properties let you configure the Splunk logging driver.

• To configure thesplunkdriver across the Docker environment, edit daemon.jsonwith the key,"log-opts": { "NAME": "VALUE",...}.
• To configure thesplunkdriver for an individual container, usedocker run with the flag,--log-opt NAME=VALUE....

If there is collision between thelabelandenvkeys, the value of theenv takes precedence. Both options add additional fields to the attributes of a logging message.

Below is an example of the logging options specified for the Splunk Enterprise instance. The instance is installed locally on the same machine on which the Docker daemon is running.

The path to the root certificate and Common Name is specified using an HTTPS scheme. This is used for verification. TheSplunkServerDefaultCertis automatically generated by Splunk certificates.

$docker run\
--log-driver=splunk \
--log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 \
--log-opt splunk-url=https://splunkhost:8088 \
--log-opt splunk-capath=/path/to/cert/cacert.pem \
--log-opt splunk-caname=SplunkServerDefaultCert \
--log-opt tag= "{{.Name}}/{{.FullID}}" \
--log-opt labels=location \
--log-opt env=TEST \
--env "TEST=false" \
--label location=west \
your/application

Thesplunk-urlfor Splunk instances hosted on Splunk Cloud is in a format likehttps://http-inputs-XXXXXXXX.splunkcloudand does not include a port specifier.

Message formats

There are three logging driver messaging formats:inline(default),json, andraw.

{
"attrs":{
"env1":"val1",
"label1":"label1"
},
"tag":"MyImage/MyContainer",
"source":"stdout",
"line":"my message"
}

{
"attrs":{
"env1":"val1",
"label1":"label1"
},
"tag":"MyImage/MyContainer",
"source":"stdout",
"line":"{\" foo\ ": \" bar\ "}"
}

{
"attrs":{
"env1":"val1",
"label1":"label1"
},
"tag":"MyImage/MyContainer",
"source":"stdout",
"line":"my message"
}

{
"attrs":{
"env1":"val1",
"label1":"label1"
},
"tag":"MyImage/MyContainer",
"source":"stdout",
"line":{
"foo":"bar"
}
}

MyImage/MyContainer env1=val1 label1=label1 my message
MyImage/MyContainer env1=val1 label1=label1 { "foo": "bar" }

Advanced options

The Splunk logging driver lets you configure a few advanced options by setting environment variables for the Docker daemon.