Splunk fields extraction for container logs

For the container logs, forwarded by the collectord, it is possible to specify field extractions rules, specific for image names, container names, or combination of them.

All container logs have source format, which includes container ID, container name, container image name, and stream.

1/docker/{docker_container_id}/{docker_container_name}/{docker_container_image}.{docker_stream}

Using this knowledge you can create field extraction rules for specific image or container, also including glob patterns, using wildcards.

As an example, you can specify field extraction for nginx container in props.conf using a wildcard character for the container ID, container name, and docker stream. This field extraction applies to all containers created from the nginx docker image.

1[source::/docker/*/*/nginx:*]
2EXTRACT-nginx-ingress-controller-http = ^(?P&lt;remote_addr&gt;[^ ]+)\s+\-\s+\[(?P&lt;proxy_add_x_forwarded_for&gt;[^\]]+)\]\s+\-\s+(?P&lt;remote_user&gt;[^ ]+)\s+\[(?P&lt;time_local&gt;[^\]]+)[^"\n]*"(?P&lt;request&gt;[^"]+)"\s+(?P&lt;status&gt;\d+)\s+(?P&lt;body_bytes_sent&gt;\d+)\s+"(?P&lt;http_referer&gt;[^"]+)"\s+"(?P&lt;http_user_agent&gt;[^"]+)"\s+(?P&lt;request_length&gt;\d+)\s+(?P&lt;request_time&gt;[^ ]+)\s+\[(?P&lt;proxy_upstream_name&gt;[^\]]+)]\s+(?P&lt;upstream_addr&gt;[^\s]+)\s+(?P&lt;upstream_response_length&gt;\d+)\s+(?P&lt;upstream_response_time&gt;[^\s]+)\s+(?P&lt;upstream_status&gt;\d+)$</code></pre>

You can also find how to use Splunk Fields Extractor to extract fields from container logs in our blog.