Send docker container logs elsewhere (Like Splunk, etc) - but still be able to view them normally from the GUI

[Chad Kunsman]

Is this possible? I sent logs from a couple containers (as a test) to my Splunk instance but now I can't view them normally within the GUI. "Configured logging driver does not support reading" 

 

I'd like both to work. 

[Turnspit]

A little bit off-topic - may I ask how you set up specific Containers to send their logs elsewhere?

[Chad Kunsman]

5 hours ago, Turnspit said:

A little bit off-topic - may I ask how you set up specific Containers to send their logs elsewhere?

 

In 'extra parameters' in the advanced view of a container config:

 

--log-driver syslog --log-opt syslog-address=tcp://192.168.1.200:9997 --log-opt tag={{.Name}}

 

You could use the 'splunk' logging driver but I didn't like the format it was giving me and preferred the traditional syslog format. So I chose that. More info here:

https://docs.docker.com/config/containers/logging/configure/