AWS ECS Task container definitions using AWS FireLens with GELF.

container_definitions.json

[
  {
    "logConfiguration": {
      "logDriver": "awsfirelens",
      "options": {
        "Port": "$gelf_udp_input_port",
        "Host": "$graylog_address",
        "Name": "gelf",
        "Mode": "udp",
        "Gelf_Short_Message_Key": "log",
        "Gelf_Host_Key": "container_name",
        "Gelf_Full_Message_Key": "log"
      }
    }
  },
  {
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "$fluentbit_sidecar_cwl_group_name",
        "awslogs-region": "$aws_region",
        "awslogs-create-group": "true",
        "awslogs-stream-prefix": "${application_name}"
      }
    },
    "memory": 100,
    "image": "$aws_for_fluent_bit_image",
    "firelensConfiguration": {
      "type": "fluentbit",
      "options": {
        "enable-ecs-log-metadata": "true"
      }
    },
    "name": "log_router"
  }
]

gelf_udp_input_port = Graylog input port for GELF-UDP. E.g.: 8000

graylog_address = Graylog address. E.g.: logs.internal

fluentbit_sidecar_cwl_group_name = CloudWatch Group name for the FluentBit sidecar. Note: Setting "awslogs-create-group" to true, means that your Task Execution Role has the required permissions.

aws_region = Please.

application_name = This is just a tip: You may or not use a stream prefix, but I hope you use.


aws_for_fluent_bit_image = The AWS For FluentBit image URI for the current AWS Region. Could be found here: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/firelens-using-fluentbit.html