Portainer Templates logo

Portainer Templates

Logzio Logs Collector Logzio Logs Collector

Container

Tools

Docker container that uses Filebeat to collect logs from other Docker containers and forward those logs to your Logz.io account.

Image details

Pulls: 12.0M
Architecture: amd64, arm64
Image size: 59 MB
Latest: 0.5.1
User: logzio
Created: Mar 25, 2019
Updated: 1 years ago
Status: active

Source details

Repo: logzio/docker-collector-logs
Stars: 16
Forks: 11
Language: Python
License: Apache-2.0
Latest: 0.5.1 · 1 years ago
Updated: 12 months ago
Status: archived

Configuration

Type
Container
Image
logzio/docker-collector-logs
Privileged
Yes
Volumes
/var/run/docker.sock : /var/run/docker.sock/var/lib/docker/containers : /var/lib/docker/containers
Env vars
LOGZIO_TOKEN=REPLACE-LOGZIO-TOKEN-HERELOGZIO_URL=listener.logz.io:5015

Template by mediadepot

Standalone Install

Select an install method, to see config/commands for deploying Logzio Logs Collector

Installation method

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select Logzio Logs Collector, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo

More install options in our documentation, or see logzio/docker-collector-logs for app-specific guidance.

docker-collector-logs

docker-collector-logs is a Docker container that uses Filebeat to collect logs from other Docker containers and forward those logs to your Logz.io account.
To use this container, you'll set environment variables in your docker run command. docker-collector-logs uses those environment variables to generate a valid Filebeat configuration for the container. docker-collector-logs mounts docker.sock and the Docker logs directory to the container itself, allowing Filebeat to collect the logs and metadata.
docker-collector-logs ships logs only. If you want to ship metrics to Logz.io, see docker-collector-metrics.

docker-collector-logs setup

  1. Pull the Docker image

Download the logzio/docker-collector-logs image:
docker pull logzio/docker-collector-logs

  1. Run the container

For a complete list of options, see the parameters below the code block.👇
docker run --name docker-collector-logs \
--env LOGZIO_TOKEN="<ACCOUNT-TOKEN>" \
--env LOGZIO_URL="<LISTENER-URL>:5015" \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-v /var/lib/docker/containers:/var/lib/docker/containers \
logzio/docker-collector-logs

Parameters

ParameterDescription
LOGZIOTOKENRequired. Your Logz.io account token. Replace <ACCOUNT-TOKEN> with the token of the account you want to ship to.
LOGZIOURLRequired. Logz.io listener URL to ship the logs to. This URL changes depending on the region your account is hosted in. For example, accounts in the US region ship to listener.logz.io, and accounts in the EU region ship to listener-eu.logz.io.
For more information, see Account region on the Logz.io Docs.
LOGZIOTYPEDefault: Docker image name
The log type you'll use with this Docker. This is shown in your logs under the type field in Kibana.
Logz.io applies parsing based on type.
LOGZIOCODECDefault: plain
Set to json if shipping JSON logs. Otherwise, set to plain.
matchContainerNameComma-separated list of containers you want to collect the logs from. If a container's name partially matches a name on the list, that container's logs are shipped. Otherwise, its logs are ignored.
Note: Can't be used with skipContainerName
skipContainerNameComma-separated list of containers you want to ignore. If a container's name partially matches a name on the list, that container's logs are ignored. Otherwise, its logs are shipped.
Note: Can't be used with matchContainerName
additionalFieldsInclude additional fields with every message sent, formatted as "fieldName1=fieldValue1;fieldName2=fieldValue2".
To use an environment variable, format as "fieldName1=fieldValue1;fieldName2=$ENVVARNAME". In that case, the environment variable should be the only value in the field. In case the environment variable can't be resolved, the field will be omitted.

Note: By default, logs from docker-collector-logs and docker-collector-metrics containers are ignored.

  1. Check Logz.io for your logs

Spin up your Docker containers if you haven’t done so already. Give your logs a few minutes to get from your system to ours, and then open Kibana.

Change log

  • 0.0.3: Support additional fields
  • 0.0.2: Add an option to configure logziocodec and logziotype

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs logzio-logs-collector
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

  • Fix the ownership: sudo chown -R 1000:1000 /var/lib/docker/containers

Can't reach the Docker socket

logzio-logs-collector talks to Docker through /var/run/docker.sock. If the logs show "permission denied while trying to connect to the Docker daemon socket", the app's user can't access it.

  • Check the socket exists on the host: ls -l /var/run/docker.sock
  • Run the container as root, or add the docker group's id to the container with group_add.

Image won't pull

Test the pull directly on the host: docker pull logzio/docker-collector-logs

  • "manifest unknown" means the tag no longer exists. This template uses latest, so try pinning a specific version instead.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Privileged mode

This template runs the container in privileged mode, giving it full access to your host.

  • Only deploy it if you trust the app.
  • If deployment is blocked, your Portainer security settings or hardened host may not allow privileged containers.

Upstream project is archived

The developers have archived logzio/docker-collector-logs, so bugs and security issues won't be fixed.

  • It'll keep working for now, but consider the similar apps below for a maintained alternative.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

A single container

Logzio Logs Collector runs as one container, the simplest kind of app here. Just the one image to pull and nothing else wired up alongside it.

The app image

An image is the app packed up ready to go, everything Logzio Logs Collector needs bundled into one download. This template pulls logzio/docker-collector-logs, which Docker fetches once (about 59 MB) and then starts your own copy from.

Where the image comes from

Docker pulls its images from registries, public libraries of ready-built apps. Logzio Logs Collector's comes from Docker Hub, published by logzio.

Version tags

The bit after the colon in the image name is the version tag. Here it's latest, which always points at the newest build, so a redeploy can bump you to a newer release without you asking. Newest right now is 0.5.1. Pin a specific tag if you would rather stay on one version.

Which machines it runs on

Every image is built for particular CPU types. This one ships for amd64, arm64, so it runs on both regular x86 servers and ARM boards like a Raspberry Pi.

Volumes

A volume is where Logzio Logs Collector keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

  • /var/run/docker.sock from /var/run/docker.sock on the host, read-only (a socket it talks to, not storage)
  • /var/lib/docker/containers from /var/lib/docker/containers on the host

Environment variables

Environment variables are the settings you hand over when you deploy, things like a password or a timezone. Logzio Logs Collector takes 2 of them, all with defaults you can leave alone or tweak:

  • LOGZIO_TOKEN, defaults to REPLACE-LOGZIO-TOKEN-HERE
  • LOGZIO_URL, defaults to listener.logz.io:5015

Networking

Nothing custom is set, so Logzio Logs Collector sits on Docker's default bridge network: its own private space that reaches the outside world only through the ports it publishes.

Container name

Once it's deployed, Portainer names the container logzio-logs-collector. That's what you'll spot in the containers list and use in commands like docker logs logzio-logs-collector.

Privileged mode

This template runs Logzio Logs Collector in privileged mode, which gives it nearly as much access to your server as the system itself. Some apps genuinely need it to reach hardware or manage the host, so it's one to run only if you trust the source.

Open source license

Logzio Logs Collector is open source, released under the Apache-2.0 license. In plain terms the code is out in the open, so you're free to run it and change it to fit what you need.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set Logzio Logs Collector up. Add the template list to Portainer once, then deploying Logzio Logs Collector is a click rather than a wall of config.