Logging

The default configuration of docker compose is not sending the logs to Splunk. Container logs can be accessed with command:

docker logs <container_name/id>

Creating logs requires updating configuration of several docker compose files. To simplify this process, inside the docker_compose package there is a manage_logs.py file which will automatically manage logs.

Prerequisites

Running script requires installation of ruamel.yaml package for python. It can be done with command:

pip3 install ruamel.yaml

The following parameters have to be configured in .env file: SPLUNK_HEC_TOKEN, SPLUNK_HEC_PROTOCOL, SPLUNK_HEC_HOST, SPLUNK_HEC_PORT, SPLUNK_LOG_INDEX, SPLUNK_HEC_INSECURESSL.

More about .env configuration can be found in .env file configuration.

Enabling logging

To enable a logging manage_logs.py must be run with the following flags:

Flag	Description
-e, --enable_logs	Flag enabling the logs
-p, --path_to_compose	Absolute path to directory with docker compose files

Example of enabling logs:

python3 manage_logs.py --path_to_compose /home/ubuntu/docker_compose --enable_logs

The script will add required configuration for logging under services in docker compose files. To apply the changes run the

sudo docker compose $(find docker* | sed -e 's/^/-f /') up -d

command inside the docker_compose directory.

Disabling the logs

To disable logs manage_logs.py must be run with the following flags:

Flag	Description
-d, --disable_logs	Flag disabling the logs
-p, --path_to_compose	Absolute path to directory with docker compose files

Running the disable command will replace the logging.driver section with default docker driver json-file.

Example of disabling logs:

python3 manage_logs.py --path_to_compose /home/ubuntu/docker_compose --disable_logs

To apply the changes run the

sudo docker compose $(find docker* | sed -e 's/^/-f /') up -d

command inside the docker_compose directory.

After that the logs can be reached with docker logs command.