Add docker image name:revision attribute to journald logging driver events

[CpuID]

Currently there is the ability to expose env and labels log-opt values for the journald log driver, to add selected environment variables and labels attached to a container to each log event.

It would be nice to have the Docker image name and revision also, either by default or as a log-opt.

I suspect this will relate to gelf/fluentd similarly as per #16961

This would give the journald log driver (when combined with journalbeat) feature parity to using docker-logstash-forwarder

[thaJeztah]

Have you tried --log-opt tag=.....? https://docs.docker.com/engine/admin/logging/log_tags/

[CpuID]

Not a bad option @thaJeztah - I guess that would make the Container ID and the Image ID into a single attribute (eg. --log-opt tag="{{.ImageName}}---{{.ID}}"), but I could easily do that with a sane delimiter and parse it out on the Logstash side.

[CpuID]

Feel free to close if there is no interest in doing this as a first class log event attribute :)

[thaJeztah]

I'm not entirely against adding them as separate properties (given that that information is already there in the context); depends a bit on how likely it is that people use this. Also when making changes to logging, performance is always important, so adding these attributes shouldn't affect performance.

I'll leave it open for now, so see if there's more interest in this.

[CpuID]

No problem, thanks :)

[thaJeztah]

There's some work being done for other logging drivers, e.g. #25633, so possibly we can reuse once it's there

[RohitK89]

👋 I opened the PR above to add this functionality.

My company is using fluent with native docker to grab logs from containers. We have docker log to journald and then use fluentbit to forward to splunk, and using a tag as the placeholder for image names seems less than ideal. Engineers requested being able to search for log messages using a proper key for the image name, so I thought I'd help make that happen!