2

I am using CoreOS which uses systemd and docker.

One of the big issues with systemd and CoreOS is that it doesn't play 100% nice with docker. Or maybe docker doesn't play 100% nice either. Another issue I'm having with it is that log events that get logged in the journal appear to come from "docker" which is not true. They come from the process that docker runs. This wouldn't normally be a huge problem, but when you forward these logs onto another service like an ELK stack, you can't figure out what are nginx logs vs other service logs. Their source is all docker!

Is there a way of getting around this? I'm using docker 1.9 which is what CoreOS Stable has. So I do not have the privilege as yet of using json output from docker directly.

Improve this question

1 Answer 1

Reset to default
0

All service files and Docker containers insert data into the systemd journal. If the event was originated by Docker container, the origin of the process is logged as Docker. You can file a bug here if you believe logs should be displayed in a different way.

Coming back to your question, did you consider forwarding docker logs to ELK instead of systemd logs?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .