Why doesn't Logstash consume logs from gelf?

Question

I'm trying to set up an interaction between running Docker container's logs and Logstash.

I run my Docker container with the following command:

docker run --log-driver gelf --log-opt gelf-address=udp://127.0.0.1:12201 nfrankel/simplelog:1

and the Logstash config.json is:

input {
  gelf {}
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
  }
  stdout {}
}

Logstash logs are fine, I see

New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]}
Starting gelf listener (udp) ... {:address=>"0.0.0.0:12201"}
Successfully started Logstash API endpoint {:port=>9600}

Nevertheless, it doesn't work. I don't see either logs in Logstash console or that Elasticsearch index is created.

Could you help me to resolve my issue?

Worth to mention that the running Docker container produces logs and I see them in a Cygwin from where I launched it.

Answer 1

Perhaps try configuring the gelf input to accept udp on port 12201 eg

input {
   gelf {
      use_udp => true
      port_udp => 12201
   }
}