Running filebeat on docker host OS and collecting logs from containers

Question

I have a server that is the host OS for multiple docker containers. Each of the containers contains an application that is creating logs. I want these logs to be sent to a single place by using the syslog daemon, and then I want filebeat to transmit this data to another server. Is it possible to install filebeat on the HOST OS (without making another container for filebeat), and make the containers applications' log data be collected by the syslog daemon and then consolidated in /var/log on the host OS? Thanks.

Answer 1

You need to share a volume with every container in order to get your logs in the host filesystem.

Then, you can install filebeat on the host and forward the logs where you want, as they were "standard" log files.

Please be aware that usually docker containers do not write they logs to real log files, but to stdout. That means that you'll probably need custom images in order to fix this logging problem.