megastef

# Run Job Definition: nomad run sematext-agent-docker.nomad
# https://www.hashicorp.com/blog/nomad.html
# More Info: https://hub.docker.com/r/sematext/sematext-agent-docker/
# http://blog.sematext.com/2015/12/15/docker-logging-partner-sematext-logsene/
job "sematext-agent-docker" {
	# set your region here
	region = "global"
	# Mandatory, parameter pls. change!
	datacenters = ["us-west-1"]
    	# run this job globally

megastef

patterns:
  - # your app name
    blockStart: !!js/regexp ^\d{4}-\d{2}-\d{2}_\d{2}:\d{2}:\d{2}
    sourceName: !!js/regexp /YOUR_IMAGE_NAME_HERE/i
    match:
      - type: YOUR_IMAGE_OR_APP_NAME
        regex: !!js/regexp /^(\d{4}-\d{2}-\d{2}_\d{2}:\d{2}:\d{2})\s+(\S+)\s+\[(.+?)\]\s{0,4}\[(.+?)\]\s-\s([\S|\s]+)/
        dateFormat: YYYY-MM-DD_HH:mm:ss
        fields:
          - ts

megastef

json: 
    enabled: true
    removeFields:
      - __CURSOR
      - __MONOTONIC_TIMESTAMP
      - _TRANSPORT
      - JOURNAL_NAME
      - JOURNAL_PATH
      - CURRENT_USE
      - CURRENT_USE_PRETTY

megastef

{
  "/": {
   "name": "/",
   "subcontainers": [
    {
     "name": "/docker"
    },
    {
     "name": "/init.scope"
    },

megastef

export SWARM_TOKEN=$(docker run swarm create)
docker-machine create \
    	-d virtualbox \
    	--engine-env 'DOCKER_OPTS="-H unix:///var/run/docker.sock"' \
    	--swarm \
    	--swarm-master \
    	--swarm-discovery token://$SWARM_TOKEN \
    	swarm-master

for NODE in {1..3}; 

megastef

originalLine: false

patterns: 
  - # log4j logs, please replace sourceName with a pattern for your image or container name 
    sourceName: !!js/regexp /.*/i
    blockStart: !!js/regexp /^\d+\/\d+\/\d+\s/
    match: 
      - regex: !!js/regexp /(\d+\/\d+\/\d+\s\d+\:\d+\:\d+)\s\S+\s\S+\s\[(\S+)\]\s(\S+)\s+(\S+)\s+-\s+([\S\|\s]+)/i
        type: yourAppNameLog4j
        fields:

megastef

[
  {
    "_id": "default",
    "_type": "dashboard",
    "_source": {
      "title": "default",
      "hits": 0,
      "description": "",
      "panelsJSON": "[{\"col\":1,\"id\":\"Map\",\"panelIndex\":1,\"row\":1,\"size_x\":5,\"size_y\":5,\"type\":\"visualization\"},{\"col\":1,\"columns\":[\"host\",\"severity\",\"message\",\"compose_project\",\"compose_container_number\",\"compose_service\",\"docker_host\",\"image_name\",\"swarm_id\"],\"id\":\"Logs\",\"panelIndex\":2,\"row\":6,\"size_x\":7,\"size_y\":5,\"sort\":[\"@timestamp\",\"desc\"],\"type\":\"search\"},{\"col\":6,\"id\":\"Containers-per-host-and-image-type\",\"panelIndex\":3,\"row\":1,\"size_x\":4,\"size_y\":5,\"type\":\"visualization\"},{\"col\":10,\"id\":\"Docker-Compose-Image-slash-Service\",\"panelIndex\":4,\"row\":1,\"size_x\":3,\"size_y\":5,\"type\":\"visualization\"},{\"id\":\"Containers-per-host\",\"type\":\"visualization\",\"panelIndex\":5,\"size_x\":3,\"size_y\":5,\"col\":10,\"row\":6}]",
      "optionsJSON": "{\"darkTheme\":false}",

megastef

# in-process monitor for Tomcat, needs less resources and no network setup
version: '2'

services:
  spm-client:
   image: sematext/spm-client
   container_name: spm-client-tc
   hostname: spm-client-tc
   environment:
    # please set env var SPM_TOKEN before you run docker-compose

megastef

spm-client:
 image: sematext/spm-client
 container_name: spm-client
 # share the network with the host to reach ES on localhost:9200
 net: host
 environment:
   # SPM Token from http://apps.sematext.com
   - SPM_CONFIG=${SPM_TOKEN} es standalone
 volumes: 
   # spm-client > v1.31.65 requires access to docker socket

megastef

originalLine: true 
geoIP: true
maxmindDbDir: /tmp/

json: 
  enabled: false


patterns:
  - # multi line test