application logs to splunk with docker!

gistfile1.txt

Getting application logs from a container to splunk

Application running in the container writes their logs to /var/log/service (placing any number of directories or files in this parent directory). This is conatiner is started with /var/log/service mounted to /var/log on the host system. We then have another container running splunk-forwarder which mounts /var/log into the container. Splunk forwarder is configured to send /var/log (recursing) to the splunk indexer in the correct data center (using consul). 

More to come!