Skillversitas

Docker Centralized Logging

Centralized logging collects logs from all containers into a single place.

ELK Stack

version: '3.8'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.10.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
    volumes:
      - es-data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"

  logstash:
    image: docker.elastic.co/logstash/logstash:8.10.0
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:8.10.0
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

  api:
    build: ./backend
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
    networks:
      - logging-net

networks:
  logging-net:

volumes:
  es-data:

Fluentd Configuration

# docker-compose.yml
services:
  fluentd:
    build: ./fluentd
    volumes:
      - ./fluentd/conf:/fluentd/etc
    ports:
      - "24224:24224"
      - "24224:24224/udp"

<!-- fluentd/conf/fluent.conf -->
<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>

<match **>
  @type elasticsearch
  host elasticsearch
  port 9200
  index_name docker-logs
</match>

Use Case: Application Logging

version: '3.8'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.10.0
    environment:
      - discovery.type=single-node
    volumes:
      - es-data:/usr/share/elasticsearch/data

  kibana:
    image: docker.elastic.co/kibana/kibana:8.10.0
    ports:
      - "5601:5601"

  api:
    build: ./backend
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  es-data:

Everyday Use Case

Case: A developer needs to view logs from all services.

# Kibana: http://localhost:5601
# Search logs by service, time, or level

# Export logs from Docker
docker logs api > api.log 2>&1

Best Practices

  1. Use structured logging: JSON format
  2. Centralized logging: ELK or similar
  3. Log rotation: Configure max-size and max-file
  4. Monitor: Watch for errors and warnings

Conclusion

Centralized logging makes monitoring and debugging easier. Use the ELK stack or similar for effective log management.