Getting Container Logs into Splunk

Our log monitoring environment is starting to take shape, but we need to get our Docker container logs into the application to make it worth the work. We have set up our Splunk forwarder to send logs from our system to the /var/log directory. Up until now, we have learned that we can simply mount the log file of our container and use the Splunk forwarder to send logs to the Splunk indexer. This is one way to do this, but Docker provides an easier option for sending logs to Splunk.

Docker provides a log driver specific to Splunk that will send our container logs via our network to an HTTP Event Collector on our Splunk installation. We'll need to open a new port to expose the Event Collector as Splunk uses port 8088 to collect data in this method. So far, we've exposed ports 8000 and 9997 on our Splunk installation. Before we proceed with the rest of this chapter, let's look at all the available ports and how they function on Splunk...