{"action":"created","issue":{"url":"https://api.github.com/repos/gliderlabs/logspout/issues/163","repository_url":"https://api.github.com/repos/gliderlabs/logspout","labels_url":"https://api.github.com/repos/gliderlabs/logspout/issues/163/labels{/name}","comments_url":"https://api.github.com/repos/gliderlabs/logspout/issues/163/comments","events_url":"https://api.github.com/repos/gliderlabs/logspout/issues/163/events","html_url":"https://github.com/gliderlabs/logspout/issues/163","id":137697868,"number":163,"title":"Custom tagging/source on logs sent to Syslog (feature)","user":{"login":"sshipway","id":1400897,"avatar_url":"https://avatars2.githubusercontent.com/u/1400897?v=4","gravatar_id":"","url":"https://api.github.com/users/sshipway","html_url":"https://github.com/sshipway","followers_url":"https://api.github.com/users/sshipway/followers","following_url":"https://api.github.com/users/sshipway/following{/other_user}","gists_url":"https://api.github.com/users/sshipway/gists{/gist_id}","starred_url":"https://api.github.com/users/sshipway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sshipway/subscriptions","organizations_url":"https://api.github.com/users/sshipway/orgs","repos_url":"https://api.github.com/users/sshipway/repos","events_url":"https://api.github.com/users/sshipway/events{/privacy}","received_events_url":"https://api.github.com/users/sshipway/received_events","type":"User","site_admin":false},"labels":[{"id":371132647,"url":"https://api.github.com/repos/gliderlabs/logspout/labels/status:%20fix-provided","name":"status: fix-provided","color":"bfdadc","default":false},{"id":99295425,"url":"https://api.github.com/repos/gliderlabs/logspout/labels/type:%20enhancement","name":"type: enhancement","color":"09ab3c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-03-01T21:53:53Z","updated_at":"2018-04-25T08:31:22Z","closed_at":null,"author_association":"NONE","body":"We have a number of Docker hosts that may be sending logs to Syslog via logspout.  These logs appear in syslog with the Docker host IP as the source.  However, we are only interested in the cluster source, not the specific host.\n\nIt would be useful to have an optional env var that can be set when starting the Logspout container, whereby you can specify the Source to use in the Syslog feed (and/or a tag to prepend to the syslog entry).  In this way, the logs would arrive at syslog with a common Source of (eg) 'cluster A' rather than one of the various IP addresses of the cluster members.\n\nAlso, being able to use the Container name or ID to prepend the log entry would help in analysis where the central log server gets thousands of such logs a second.\n\nAs Docker infrastructures grow in size, this could be come a very useful feature to have available.\n"},"comment":{"url":"https://api.github.com/repos/gliderlabs/logspout/issues/comments/384205254","html_url":"https://github.com/gliderlabs/logspout/issues/163#issuecomment-384205254","issue_url":"https://api.github.com/repos/gliderlabs/logspout/issues/163","id":384205254,"user":{"login":"itkroplis","id":29997706,"avatar_url":"https://avatars0.githubusercontent.com/u/29997706?v=4","gravatar_id":"","url":"https://api.github.com/users/itkroplis","html_url":"https://github.com/itkroplis","followers_url":"https://api.github.com/users/itkroplis/followers","following_url":"https://api.github.com/users/itkroplis/following{/other_user}","gists_url":"https://api.github.com/users/itkroplis/gists{/gist_id}","starred_url":"https://api.github.com/users/itkroplis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itkroplis/subscriptions","organizations_url":"https://api.github.com/users/itkroplis/orgs","repos_url":"https://api.github.com/users/itkroplis/repos","events_url":"https://api.github.com/users/itkroplis/events{/privacy}","received_events_url":"https://api.github.com/users/itkroplis/received_events","type":"User","site_admin":false},"created_at":"2018-04-25T08:31:22Z","updated_at":"2018-04-25T08:31:22Z","author_association":"NONE","body":"I ran into a similar requirement. We run containers on mesos/marathon so container IDs and names are not very meaningful so wanted to add a set of arbitrary tags to each container so that we can later do some grouping and parsing (we use ELK as a central log repository).\r\n\r\nWe we ended up doing is use the SYSLOG_TAG env variable on each container and added the tags we want as key value pairs for example:\r\ndocker run -d -e \"SYSLOG_TAG=key1:val1,key2:val2,key_n:val_n\" our_docker_app\r\n\r\nWe then ran logspout like this:\r\ndocker run --volume=/var/run/docker.sock:/var/run/docker.sock -e SYSLOG_TAG={{.Container.Config.Env}} glirlabs/logspout syslog+tcp://IP:PORT\r\n\r\nThis ended up outputting a message that looked like the following:\r\n\"<14>1 2016-03-18T15:57:33Z feb5540feb8c [SYSLOG_TAG=tenant:nextgen,role:elasticsearch,app:master,source:logspuot,csp_oss_type:logs,csp_oss_codec:elasticsearch] 4650 - - I am up..\",\r\n\r\nWe then parse SYSLOG_TAG with a kv filter in logstash.\r\n\r\nHope this helps someone.\r\n\r\n=================\r\n\r\nCan get a real example, step by step? For example, portainer docker?\r\nsequential examples of commands?\r\n"}}
{"actor":{"display_login":"itkroplis"}}