Configuring syslog address via environment or configuration file

[rarkins]

We use docker-compose, therefore the CMD for logspout is embedded in docker-compose.yml. However, the syslog addresses we use will be different per environment.

Can the syslog URI be provided at runtime in any way other than as a command line argument?

I'm also open to any other suggestions for how to have different destinations for production, staging, test, dev, etc.

[cweagans]

I'm also interested in this. Hoping to run Logspout on Dokku and I don't have any way to pass an argument to the end of the docker command.

[progrium]

Going to make it easier to add routes via environment. However, the routesapi lets you add them via HTTP, but that's far from ideal in your case.

[markthom-as]

+1 On this...
Is there a way to hack this now by modifiying $ROUTE_URIS or $ROUTE?

I'm trying to get logspout working in a kubernetes cluster.

[ardigo]

Also interested into being able to run logspout inside kubernetes.
Has this been solved?

[markthom-as]

I was able to get it working on kubernetes, sending to papertrail with the following YAML:

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: logspout
  labels:
    tier: monitoring
    app: logspout
    version: v1
spec:
  template:
    metadata:
      labels:
        name: logspout
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      containers:
        - resources:
            requests:
              cpu: 0.15
          securityContext:
            privileged: true
          env:
            - name: SYSLOG_TAG
              value: '{{ index .Container.Config.Labels "io.kubernetes.pod.namespace" }}[{{ index .Container.Config.Labels "io.kubernetes.pod.name" }}]'
            - name: SYSLOG_HOSTNAME
              value: 'ENVIRONMENT_PREFIX-{{ index .Container.Config.Labels "io.kubernetes.container.name" }}'
            - name: ROUTE_URIS
              value: syslog+tls://logs.papertrailapp.com:YOUR_PORT
          image: gliderlabs/logspout
          name: logspout
          volumeMounts:
            - name: log
              mountPath: /var/run/docker.sock
      volumes:
        - name: log
          hostPath:
              path: /var/run/docker.sock

[ardigo]

@markthom-as

Thank you so much for this file. I have been able to forward my logs to Papertrail.
Is there anyway to filter which pods I want to log? Like, I would not want to send the heapster-nanny logs to PPT.

Thanks.

[bakavic]

@ardigo

As most of the chatty stuff happens in the kube-system kubernetes namespace, you can exclude it (or rather just filter by) the namespaces that you're using, which is normally the default namespace.

- name: ROUTE_URIS
              value: syslog+tls://logs.papertrailapp.com:YOUR_PORT?filter.name=*default*

Not sure if there is a way to exclude in logspout itself, as opposed to setting environment variables in containers (which might be beyond our control, like stuff in kube-system.

[ardigo]

@bakavic

Thanks, but I have not been able to replicate.
From what I understood from documentation, filter-name will include the objects listed after it, right?
In my environment I have multiple namespaces (lets say, DEV and QA running on the same cluster), so I would like to include numerous namespaces like dev, qa and default (excluding just kube-system, for instance).
I looked at the EXCLUDE-LABEL parameter on logspout docs, but have not been able to figure out how to use them on my kubernetes file.

Any help?

[bakavic]

@ardigo

Using EXCLUDE_LABEL requires you to be able to assign your own container labels to the kube-system containers, but I think that would be difficult.

Unfortunately EXCLUDE_LABEL currently checks for only for true for the label specified.

We can't exclude by checking if a particular label is is equal to something (The kube containers all have io.kubernetes.pod.namespace=kube-system, IIRC).

Guess it won't be too much of a stretch to change it so that the value of EXCLUDE_LABEL can be specified (perhaps with <LABEL_NAME>:<LABEL_VALUE> ?)

In my environment I have multiple namespaces (lets say, DEV and QA running on the same cluster), so I would like to include numerous namespaces like dev, qa and default (excluding just kube-system, for instance).

This is still possible for now with the following:

filter.name=*dev*%2C*qa*%2C*default* - this might accidently filter in more than expected, if your syslog hostnames contain dev, etc inside though.

EDIT: Filtering namespaces by labels doesn't seem workable, as heapster-nanny only has the following labels:

Labels:		k8s-app=heapster
		pod-template-hash=1847815531
		version=v1.2.0

[mmautner]

I believe this is already configurable via the ROUTE_URIS environment variable:

#217 (comment)

[michaelshobbs]

Closing as ROUTE_URIS seems like a viable solution here. We can re-open if that's not a workable solution