memorial-day-systemd-docker-fun

gistfile1.txt

root@docker01:/etc/systemd/system# cat dockerlog-json.service 
[Unit]
Description=Send Docker logs via Journalctl to Syslog (JSON)

[Service]
TimeoutStartSec=0
ExecStart=/bin/sh -c '/bin/journalctl -u docker.service -o json -f | /usr/bin/ncat 192.168.2.136 1515'

Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target

root@logstash:~# cat /etc/logstash/conf.d/systemd.conf 
input {
  tcp {
    port  => 1515
    codec => json_lines
    type  => "systemd"
  }
}

filter {
  if [type] == "systemd" {
    mutate { rename => [ "MESSAGE", "message" ] }
    mutate { rename => [ "_SYSTEMD_UNIT", "program" ] }
  }
}

filter {
   kv { source => "message" } 
}

output {
  elasticsearch {}
}