Similarly, our initial approach is to forward task output with logstash to
a central (syslog) location. Our applications prepend their output with
"app:<appname>"; we parse this to set the syslog app name, falling back to
"mesos" if we can't figure it out.
It's certainly not perfect but has been working for us so far. Here's out
logstash config:
input {
file {
path => "/tmp/mesos/slaves/*/frameworks/*/executors/*/runs/latest/*"
}
}
filter {
grok {
match => [ "message", "app:%{USERNAME:app} (?<message>.*)" ]
overwrite => [ "message" ]
}
if [app] !~ ".+" {
mutate {
replace => ["app", "mesos-cluster-1"]
}
}
}
output {
syslog {
appname => "%{[app]}"
host => "syslog.mycompany.com"
port => 514
severity => "informational"
facility => "user-level"
}
}
On Mon, Sep 8, 2014 at 4:30 AM, mccraig mccraig <[email protected]>
wrote:
> i've recently set up :
>
> - logstash-forwarder on each slave collecting from /var/log/syslog and
> forwarding to
> - logstash instances running in docker containers on mesos, behind an
> HAProxy
> configured from the marathon API
>
> for docker containerized apps, which is most of mine, i'm mounting the
> host's /dev/log into each container, and sending logging there
>
> it's working great so far, and was pretty easy to set up
>
> :c
>
>
> On Mon, Sep 8, 2014 at 12:05 PM, Ankur Chauhan <[email protected]> wrote:
>
>> Hi all,
>>
>> I was wondering what people use for application logging? I currently can
>> thing of a couple of options but just wanted to know if others could also
>> share experiences with different logging strategies.
>>
>> Option 1: Use a shared volume on the hosts and all the application log to
>> regular files in it. Something like
>> /mnt/logs/<app_name>/taskId_<logname>.log
>>
>> Option 2: send the logs to syslog/rsyslog and use a centralized logging
>> server of sorts
>>
>> Are there any other options?
>>
>> -- Ankur Chauhan
>>
>
>
