winston console -> docker gelf log -> logstash

index.js

'use strict';

let winston = require('winston');

//
// Test with json format
//

let logger = new winston.Logger({
  transports: [
    new winston.transports.Console({
      handleExceptions: true,
      json: true,
      stringify: true
    })
  ],
  exitOnError: false
});

logger.log('error', `Error Message json`, {anything: 'This is metadata'});
logger.log('info', `Info Message json`, {anything: 'This is metadata'});

//
// Test with default kv format
//

logger = new winston.Logger({
  transports: [
    new winston.transports.Console({
      handleExceptions: true
    })
  ],
  exitOnError: false
});

logger.log('error', `Error Message kv`, {a: 'This is metadata', b: 'x'});
logger.log('info', `Info Message kv`, {anything: 'This is metadata'});

logstash.conf

input {
  gelf {
    port => 5229
  }
}

filter {
  mutate {
    replace => { "full_message" => "%{message}" }
  }

  if [message] =~ /^{.*}$/
  {
    json {
      source => "message"
      target => "fields"
    }
    mutate {
      add_field => ["level_name", "%{[fields][level]}"]
    }
    mutate {
      replace => { "message" => "%{[fields][message]}" }
    }
    mutate {
      remove_field => [ "[fields][level]", "[fields][message]" ]
    }
  } else {
    grok {
      match => { "message" => "(?<level_name>^(emerg|alert|crit|error|warn|warning|notice|info|verbose|debug|silly)): " }
    }
    mutate {
      gsub => [ "message", "=([^,]*),", "=[\1],"]
    }
    mutate {
      gsub => [ "message", "=([^,]*)$", "=[\1]"]
    }
    kv {
      source => "message"
      target => "fields"
      recursive => "true"
      field_split => ", "
    }
    mutate {
      gsub => [ "message", " [A-z][A-z0-9]*=([^,]*)(,|$)", ""]
    }
    mutate {
      gsub => [ "message", "^(emerg|alert|crit|error|warn|warning|notice|info|verbose|debug|silly): ", ""]
    }
  }
}

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
  }
}

run_test.sh

#!/bin/bash

docker run \
  -v ${PWD}/index.js:/index.js \
  -v ${PWD}/package.json:/package.json \
  -v ${PWD}/node_modules:/node_modules \
  --label greet=hi \
  --log-driver=gelf \
  --log-opt gelf-address=udp://192.168.99.100:5229 \
  --log-opt tag="docker-stage" \
  --log-opt labels=greet \
  node:4-slim \
  node index.js