docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

chore: tier 1 freshness: content/config/containers/logging/splunk.md 

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
This commit is contained in:
David Karlsson 2023-10-27 15:14:35 +02:00
parent 5c1b17beb7
commit ec07c18734
1 changed files with 77 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

146
content/config/containers/logging/splunk.md
View File

@ -1,10 +1,10 @@
--- ---
description: Describes how to use the Splunk logging driver. description: Learn how to use the Splunk logging driver with Docker Engine
keywords: splunk, docker, logging, driver keywords: splunk, docker, logging, driver
title: Splunk logging driver title: Splunk logging driver
aliases: aliases:
- /engine/reference/logging/splunk/ - /engine/reference/logging/splunk/
- /engine/admin/logging/splunk/ - /engine/admin/logging/splunk/
--- ---
The `splunk` logging driver sends container logs to The `splunk` logging driver sends container logs to
@ -46,38 +46,38 @@ configuring Docker using `daemon.json`, see
To use the `splunk` driver for a specific container, use the commandline flags To use the `splunk` driver for a specific container, use the commandline flags
`--log-driver` and `log-opt` with `docker run`: `--log-driver` and `log-opt` with `docker run`:
``` ```
docker run --log-driver=splunk --log-opt splunk-token=VALUE --log-opt splunk-url=VALUE ... docker run --log-driver=splunk --log-opt splunk-token=VALUE --log-opt splunk-url=VALUE ...
``` ```
## Splunk options ## Splunk options
The following properties let you configure the splunk logging driver. The following properties let you configure the Splunk logging driver.
- To configure the `splunk` driver across the Docker environment, edit - To configure the `splunk` driver across the Docker environment, edit
`daemon.json` with the key, `"log-opts": {"NAME": "VALUE", ...}`. `daemon.json` with the key, `"log-opts": {"NAME": "VALUE", ...}`.
- To configure the `splunk` driver for an individual container, use `docker run` - To configure the `splunk` driver for an individual container, use `docker run`
with the flag, `--log-opt NAME=VALUE ...`. with the flag, `--log-opt NAME=VALUE ...`.
| Option | Required | Description | | Option | Required | Description |
|:----------------------------|:---------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | :-------------------------- | :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `splunk-token` | required | Splunk HTTP Event Collector token. | | `splunk-token` | required | Splunk HTTP Event Collector token. |
| `splunk-url` | required | Path to your Splunk Enterprise, self-service Splunk Cloud instance, or Splunk Cloud managed cluster (including port and scheme used by HTTP Event Collector) in one of the following formats: `https://your_splunk_instance:8088`, `https://input-prd-p-XXXXXXX.cloud.splunk.com:8088`, or `https://http-inputs-XXXXXXXX.splunkcloud.com`. | | `splunk-url` | required | Path to your Splunk Enterprise, self-service Splunk Cloud instance, or Splunk Cloud managed cluster (including port and scheme used by HTTP Event Collector) in one of the following formats: `https://your_splunk_instance:8088`, `https://input-prd-p-XXXXXXX.cloud.splunk.com:8088`, or `https://http-inputs-XXXXXXXX.splunkcloud.com`. |
| `splunk-source` | optional | Event source. | | `splunk-source` | optional | Event source. |
| `splunk-sourcetype` | optional | Event source type. | | `splunk-sourcetype` | optional | Event source type. |
| `splunk-index` | optional | Event index. | | `splunk-index` | optional | Event index. |
| `splunk-capath` | optional | Path to root certificate. | | `splunk-capath` | optional | Path to root certificate. |
| `splunk-caname` | optional | Name to use for validating server certificate; by default the hostname of the `splunk-url` is used. | | `splunk-caname` | optional | Name to use for validating server certificate; by default the hostname of the `splunk-url` is used. |
| `splunk-insecureskipverify` | optional | Ignore server certificate validation. | | `splunk-insecureskipverify` | optional | Ignore server certificate validation. |
| `splunk-format` | optional | Message format. Can be `inline`, `json` or `raw`. Defaults to `inline`. | | `splunk-format` | optional | Message format. Can be `inline`, `json` or `raw`. Defaults to `inline`. |
| `splunk-verify-connection` | optional | Verify on start, that docker can connect to Splunk server. Defaults to true. | | `splunk-verify-connection` | optional | Verify on start, that Docker can connect to Splunk server. Defaults to true. |
| `splunk-gzip` | optional | Enable/disable gzip compression to send events to Splunk Enterprise or Splunk Cloud instance. Defaults to false. | | `splunk-gzip` | optional | Enable/disable gzip compression to send events to Splunk Enterprise or Splunk Cloud instance. Defaults to false. |
| `splunk-gzip-level` | optional | Set compression level for gzip. Valid values are -1 (default), 0 (no compression), 1 (best speed) ... 9 (best compression). Defaults to [DefaultCompression](https://golang.org/pkg/compress/gzip/#DefaultCompression). | | `splunk-gzip-level` | optional | Set compression level for gzip. Valid values are -1 (default), 0 (no compression), 1 (best speed) ... 9 (best compression). Defaults to [DefaultCompression](https://golang.org/pkg/compress/gzip/#DefaultCompression). |
| `tag` | optional | Specify tag for message, which interpret some markup. Default value is `{{.ID}}` (12 characters of the container ID). Refer to the [log tag option documentation](log_tags.md) for customizing the log tag format. | | `tag` | optional | Specify tag for message, which interpret some markup. Default value is `{{.ID}}` (12 characters of the container ID). Refer to the [log tag option documentation](log_tags.md) for customizing the log tag format. |
| `labels` | optional | Comma-separated list of keys of labels, which should be included in message, if these labels are specified for container. | | `labels` | optional | Comma-separated list of keys of labels, which should be included in message, if these labels are specified for container. |
| `labels-regex` | optional | Similar to and compatible with `labels`. A regular expression to match logging-related labels. Used for advanced [log tag options](log_tags.md). | | `labels-regex` | optional | Similar to and compatible with `labels`. A regular expression to match logging-related labels. Used for advanced [log tag options](log_tags.md). |
| `env` | optional | Comma-separated list of keys of environment variables, which should be included in message, if these variables are specified for container. | | `env` | optional | Comma-separated list of keys of environment variables, which should be included in message, if these variables are specified for container. |
| `env-regex` | optional | Similar to and compatible with `env`. A regular expression to match logging-related environment variables. Used for advanced [log tag options](log_tags.md). | | `env-regex` | optional | Similar to and compatible with `env`. A regular expression to match logging-related environment variables. Used for advanced [log tag options](log_tags.md). |
If there is collision between the `label` and `env` keys, the value of the `env` If there is collision between the `label` and `env` keys, the value of the `env`
takes precedence. Both options add additional fields to the attributes of a takes precedence. Both options add additional fields to the attributes of a
@ -91,7 +91,6 @@ The path to the root certificate and Common Name is specified using an HTTPS
scheme. This is used for verification. The `SplunkServerDefaultCert` is scheme. This is used for verification. The `SplunkServerDefaultCert` is
automatically generated by Splunk certificates. automatically generated by Splunk certificates.
```console ```console
$ docker run \ $ docker run \
--log-driver=splunk \ --log-driver=splunk \
@ -107,7 +106,6 @@ $ docker run \
your/application your/application
``` ```
The `splunk-url` for Splunk instances hosted on Splunk Cloud is in a format The `splunk-url` for Splunk instances hosted on Splunk Cloud is in a format
like `https://http-inputs-XXXXXXXX.splunkcloud.com` and does not include a like `https://http-inputs-XXXXXXXX.splunkcloud.com` and does not include a
port specifier. port specifier.
@ -117,66 +115,72 @@ port specifier.
There are three logging driver messaging formats: `inline` (default), `json`, There are three logging driver messaging formats: `inline` (default), `json`,
and `raw`. and `raw`.
{{< tabs >}}
{{< tab name="Inline" >}}
The default format is `inline` where each log message is embedded as a string. The default format is `inline` where each log message is embedded as a string.
For example: For example:
```json ```json
{ {
"attrs": { "attrs": {
"env1": "val1", "env1": "val1",
"label1": "label1" "label1": "label1"
}, },
"tag": "MyImage/MyContainer", "tag": "MyImage/MyContainer",
"source": "stdout", "source": "stdout",
"line": "my message" "line": "my message"
} }
``` ```
```json ```json
{ {
"attrs": { "attrs": {
"env1": "val1", "env1": "val1",
"label1": "label1" "label1": "label1"
}, },
"tag": "MyImage/MyContainer", "tag": "MyImage/MyContainer",
"source": "stdout", "source": "stdout",
"line": "{\"foo\": \"bar\"}" "line": "{\"foo\": \"bar\"}"
} }
``` ```
> **Note**: If your messages are JSON objects, you may want to embed them in the {{< /tab >}}
> message we send to Splunk. {{< tab name="JSON" >}}
To format messages as `json` objects, set `--log-opt splunk-format=json`. The To format messages as `json` objects, set `--log-opt splunk-format=json`. The
driver trys to parse every line as a JSON object and send it as an embedded driver attempts to parse every line as a JSON object and send it as an embedded
object. If it cannot parse the message, it is sent `inline`. For example: object. If it can't parse the message, it's sent `inline`. For example:
```json ```json
{ {
"attrs": { "attrs": {
"env1": "val1", "env1": "val1",
"label1": "label1" "label1": "label1"
}, },
"tag": "MyImage/MyContainer", "tag": "MyImage/MyContainer",
"source": "stdout", "source": "stdout",
"line": "my message" "line": "my message"
} }
``` ```
```json ```json
{ {
"attrs": { "attrs": {
"env1": "val1", "env1": "val1",
"label1": "label1" "label1": "label1"
}, },
"tag": "MyImage/MyContainer", "tag": "MyImage/MyContainer",
"source": "stdout", "source": "stdout",
"line": { "line": {
"foo": "bar" "foo": "bar"
} }
} }
``` ```
{{< /tab >}}
{{< tab name="Raw" >}}
To format messages as `raw`, set `--log-opt splunk-format=raw`. Attributes To format messages as `raw`, set `--log-opt splunk-format=raw`. Attributes
(environment variables and labels) and tags are prefixed to the message. For (environment variables and labels) and tags are prefixed to the message. For
example: example:
@ -186,13 +190,17 @@ MyImage/MyContainer env1=val1 label1=label1 my message
MyImage/MyContainer env1=val1 label1=label1 {"foo": "bar"} MyImage/MyContainer env1=val1 label1=label1 {"foo": "bar"}
``` ```
{{< /tab >}}
{{< /tabs >}}
## Advanced options ## Advanced options
Splunk Logging Driver allows you to configure few advanced options by specifying next environment variables for the Docker daemon. The Splunk logging driver lets you configure a few advanced options by setting
environment variables for the Docker daemon.
| Environment variable name | Default value | Description | | Environment variable name | Default value | Description |
|:-------------------------------------------------|:--------------|:---------------------------------------------------------------------------------------------------------------------------------------------------| | :----------------------------------------------- | :------------ | :--------------------------------------------------------------------------------------------------------------------------------------- |
| `SPLUNK_LOGGING_DRIVER_POST_MESSAGES_FREQUENCY` | `5s` | If there is nothing to batch how often driver posts messages. You can think about this as the maximum time to wait for more messages to batch. | | `SPLUNK_LOGGING_DRIVER_POST_MESSAGES_FREQUENCY` | `5s` | The time to wait for more messages to batch. |
| `SPLUNK_LOGGING_DRIVER_POST_MESSAGES_BATCH_SIZE` | `1000` | How many messages driver should wait before sending them in one batch. | | `SPLUNK_LOGGING_DRIVER_POST_MESSAGES_BATCH_SIZE` | `1000` | The number of messages that should accumulate before sending them in one batch. |
| `SPLUNK_LOGGING_DRIVER_BUFFER_MAX` | `10 * 1000` | If driver cannot connect to remote server, what is the maximum amount of messages it can hold in buffer for retries. | | `SPLUNK_LOGGING_DRIVER_BUFFER_MAX` | `10 * 1000` | The maximum number of messages held in buffer for retries. |
| `SPLUNK_LOGGING_DRIVER_CHANNEL_SIZE` | `4 * 1000` | How many pending messages can be in the channel which is used to send messages to background logger worker, which batches them. | | `SPLUNK_LOGGING_DRIVER_CHANNEL_SIZE` | `4 * 1000` | The maximum number of pending messages that can be in the channel used to send messages to background logger worker, which batches them. |