use docker autodiscovery

docker-compose.yml

@@ -9,6 +9,8 @@ services:
       args:
         USER_ID: ${USER_ID}
         GROUP_ID: ${GROUP_ID}
+    labels:
+      co.elastic.logs/fileset.stderr: error
     environment:
       APP_ENV: dev
       DATABASE_USER: root
@@ -48,6 +50,10 @@ services:
     container_name: petstore-nginx
     hostname: petstore-nginx
     image: nginx:1.17.8
+    labels:
+      co.elastic.logs/module: nginx
+      co.elastic.logs/fileset.stdout: access
+      co.elastic.logs/fileset.stderr: error
     ports:
       - '10080:80'
       - '10443:443'
@@ -83,8 +89,11 @@ services:
     container_name: petstore-filebeat
     hostname: petstore-filebeat
     image: docker.elastic.co/beats/filebeat:7.5.2
+    user: root
     volumes:
-      - ./docker/dev/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
+      - ./docker/prod/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./:/var/www/html:ro
     depends_on:
       - elasticsearch

docker/dev/php/Dockerfile

@@ -69,14 +69,7 @@ RUN if [ -n "$USER_ID" ] && [ "$USER_ID" -lt 60001 ]; then \
 RUN usermod -s /bin/bash www-data && \
     echo 'www-data ALL=(ALL) NOPASSWD: ALL' > '/etc/sudoers.d/www-data'
 
-RUN mkdir -p /var/www \
-    && chown -R www-data:www-data /var/www \
-    && touch /var/log/php-cli.err.log \
-    && chown www-data:www-data /var/log/php-cli.err.log \
-    && touch /var/log/php-fpm.log \
-    && chown www-data:www-data /var/log/php-fpm.log \
-    && touch /var/log/php-fpm.err.log \
-    && chown www-data:www-data /var/log/php-fpm.err.log
+RUN mkdir -p /var/www && chown www-data:www-data /var/www
 
 USER www-data
 

docker/prod/filebeat/filebeat.yml

@@ -0,0 +1,24 @@
+filebeat.config:
+  modules:
+    path: ${path.config}/modules.d/*.yml
+    reload.enabled: false
+
+filebeat.autodiscover:
+  providers:
+    - type: docker
+      hints.enabled: true
+    - type: docker
+      templates:
+        - condition.contains:
+            docker.container.name: petstore-php
+          config:
+            - type: log
+              paths:
+                - /var/www/html/var/log/*/*.log
+              json.keys_under_root: true
+
+processors:
+- add_cloud_metadata: ~
+
+output.elasticsearch:
+  hosts: 'elasticsearch:9200'

docker/prod/php/Dockerfile

@@ -40,14 +40,7 @@ COPY prod/nginx/files /
 
 RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer
 
-RUN mkdir -p /var/www \
-    && chown -R www-data:www-data /var/www \
-    && touch /var/log/php-cli.err.log \
-    && chown www-data:www-data /var/log/php-cli.err.log \
-    && touch /var/log/php-fpm.log \
-    && chown www-data:www-data /var/log/php-fpm.log \
-    && touch /var/log/php-fpm.err.log \
-    && chown www-data:www-data /var/log/php-fpm.err.log
+RUN mkdir -p /var/www && chown www-data:www-data /var/www
 
 USER www-data
 

docker/prod/php/files/etc/php/7.4/cli/php.ini

@@ -5,7 +5,7 @@ error_reporting = 0
 display_errors = Off
 display_startup_errors = Off
 log_errors = On
-error_log = /var/log/php-cli.err.log
+error_log = /proc/self/fd/2
 default_charset = utf-8
 allow_url_fopen = On
 allow_url_include = Off

docker/prod/php/files/etc/php/7.4/fpm/php-fpm.conf

@@ -1,6 +1,7 @@
+[global]
+error_log = /proc/self/fd/2
+
 [default]
-user = www-data
-group = www-data
 listen = 0.0.0.0:9000
 pm = dynamic
 pm.max_children = 10
@@ -10,3 +11,5 @@ pm.max_spare_servers = 4
 pm.max_requests = 400
 request_terminate_timeout = 600
 clear_env=no
+access.log = /proc/self/fd/1
+catch_workers_output = yes

docker/prod/php/files/etc/php/7.4/fpm/php.ini

@@ -6,7 +6,7 @@ error_reporting = 0
 display_errors = Off
 display_startup_errors = Off
 log_errors = On
-error_log = /var/log/php-fpm.err.log
+error_log = /proc/self/fd/2
 post_max_size = 50M
 default_charset = utf-8
 upload_max_filesize = 50M