Edge Delta Docker Source

Overview

The Docker source node captures log input from Docker containers.

• outgoing_data_types: log

Example Configuration

nodes:
  - name: my_docker_input
    type: docker_input
    include:
      - "container.image.name=.*"

Required Parameters

name

A descriptive name for the node. This is the name that will appear in Visual Pipelines and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: docker_input

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

auto_detect_line_pattern

The auto_detect_line_pattern parameter detects line patterns automatically based on the Ragel FSM Based Lexical Recognition process. There is no need to specify line_pattern explicitly if it is set to true. It is specified with a Boolean, the default is false and it is optional.

nodes:
  - name: my_docker_input
    type: docker_input
    auto_detect_line_pattern: true

boost_stacktrace_detection

The boost_stacktrace_detection parameter is used with auto_detect_line_pattern: true. It enables stack trace detection based on the Ragel FSM Based Lexical Recognition process. Found stack traces will be grouped together in the same log message. It is specified with a Boolean, the default is false and it is optional.

nodes:
  - name: my_docker_input
    type: docker_input
    auto_detect_line_pattern: true
    boost_stacktrace_detection: true

exclude and include

The include and exclude parameter are used to filter based on Docker components. They are specified with Golang regex or full text. If exclude is specified it drops logs that match its Golang regex rules. Comma separated values indicate AND rules, while separate rules indicate OR matching. In this example logs that match rule-1 and rule-2 are excluded. Logs that match rule-3 are also excluded. A log matching only rule-1 would not be excluded.

• If neither include nor exclude are specified, then everything from the input is passed.
• If include is specified as well as exclude, then logs matching in include are passed unless they are dropped by exclude.

nodes:
  - name: <node name>
    type: docker_input
    exclude:
        - "rule-1,rule-2"
        - "rule-3"

The following values can be filtered for a Docker source:

• docker.container.name
• docker.image.name

For example:

• "container.image.name=.*"

line_pattern

The line_pattern parameter specifies a Golang regex pattern that will be used as a line break rather than using a new line. It is specified with a Golang regex pattern, including a ^ for the line start, and it is optional.

nodes:
  - name: my_docker_input
    type: docker_input
    line_pattern: "^\d{4}-\d{2}-\d{2}"

sampling

The sampling parameter specifies the rate of sampling for Docker source payloads. This value should be 0.0 or 1.0. It is specified with a boolean, with false being 0.0 and true being 1.0. The default is false, and it is optional.

nodes:
  - name: my_docker_input
    type: docker_input
    sampling: true