Syslog driver not working with docker compose and elk stack

Question

I want to send logs from one container running my_service to another running the ELK stack with the syslog driver (so I will need the logstash-input-syslog plugin installed).

I am tweaking this elk image (and tagging it as elk-custom) via the following Dockerfile-elk

(using port 514 because this seems to be the default port)

FROM sebp/elk

WORKDIR /opt/logstash/bin

RUN ./logstash-plugin install logstash-input-syslog

EXPOSE 514

Running my services via a docker-compose as follows more or less:

 elk-custom:
    # image: elk-custom
    build:
      context: .
      dockerfile: Dockerfile-elk
    ports:
      - 5601:5601
      - 9200:9200
      - 5044:5044
      - 514:514

  my_service:
    image: some_image_from_my_local_registry
    depends_on:
      - elk-custom
    logging:
     driver: syslog
     options:
       syslog-address: "tcp://elk-custom:514"

However:

ERROR: for b4cd17dc1142_namespace_my_service_1 Cannot start service my_service: failed to initialize logging driver: dial tcp: lookup elk-custom on 10.14.1.31:53: server misbehaving

ERROR: for api Cannot start service my_service: failed to initialize logging driver: dial tcp: lookup elk-custom on 10.14.1.31:53: server misbehaving ERROR: Encountered errors while bringing up the project.

Any suggestions?

UPDATE: Apparently nothing seems to be listening on port 514, cause from within the container, the command netstat -a shows nothing on this port....no idea why...

Answer 1

You need to use tcp://127.0.0.1:514 instead of tcp://elk-custom:514. Reason being this address is being used by docker and not by the container. That is why elk-custom is not reachable.

So this will only work when you map the port (which you have done) and the elk-service is started first (which you have done) and the IP is reachable from the docker host, for which you would use tcp://127.0.0.1:514