Using docker GELF driver env/labels in logstash
docker, logstash
Solution
After reading the PR that added this option, I realised that I misunderstood how it was supposed to work.
`--log-opt labels=a,b,c` (same with env) define keys to include in the GELF event. The values are actually retrieved from docker labels and environment variables respectively.
`--log-opt labels=foo --label foo=bar` will include `foo: bar` in the event.
Problem
Docker GELF log driver allows `env` and `labels` log-opts: The labels and env options are supported by the gelf logging driver. It adds additional key on the extra fields, prefixed by an underscore (_) (ref) I want to use this in my index name for elasticsearch output but I couldn't figure out how I can access these value or said `extra` fields. Assuming that I have these options running a container, ``` docker run -it \ --log-driver gelf \ --log-opt gelf-address=udp://127.0.0.1:12201 \ --log-opt tag=some-app \ --log-opt env=staging \ --log-opt labels=staging \ ubuntu:16.04 /bin/bash -c 'echo Hello World' ``` I'd like to use the `env` value that I passed in my logstash config as such: ``` input { gelf { } } output { elasticsearch { hosts => ["http://127.0.0.1:9200"] index => "logstash-%{env-value-here}-%{tag}-%{+YYYY.MM.dd}" } } ``` There seems to be another question about env/labels with Graylog: Docker GELF driver env option