Platform logging

Logging for Deis components and deployed applications is handled by two components: Logger and Logspout.

deis-logspout runs on all CoreOS hosts, collects logs from running containers and sends their logs to /deis/logs/host and /deis/logs/port.

deis-logger collects the logs sent by logspout and archives them for use by Controller when a client runs deis logs. This component publishes its host and port to /deis/logs/host and /deis/logs/port, and is typically the service which consumes logs from deis-logspout.

Application log drain

Application logs can be drained to an external syslog server (or compatible service such as Logstash, Papertrail, Splunk etc).

$ deisctl config logs set drain=syslog://

This will send all application logs - there is currently no way to drain logs per application.

Routing host logs to a custom location

Logging to an external location can be achieved without modifying the log flow within Deis - we can simply send the master journal on a CoreOS host using ncat. For example, if I’m using the Papertrail hosted log service, I can forward all logs on a host to Papertrail using the host and port provided to me by Papertrail:

$ journalctl -o short -f | ncat --ssl 23654

This is really only useful when shipped as a service that we don’t have to run ourselves in a shell. We can use a fleet service for this:

Description=Log forwarder

ExecStart=/bin/sh -c "journalctl -o short -f | ncat --ssl 23654"



Save the file as log-forwarder.service. Load and start the service with fleetctl load log-forwarder.service && fleetctl start log-forwarder.service.

Shortly thereafter, you should start to see logs from every host in your cluster appear in the Papertrail dashboard.