Using docker GELF driver env/labels in logstash

Question

Docker GELF log driver allows env and labels log-opts:

The labels and env options are supported by the gelf logging driver. It adds additional key on the extra fields, prefixed by an underscore (_) (ref)

I want to use this in my index name for elasticsearch output but I couldn't figure out how I can access these value or said extra fields.

Assuming that I have these options running a container,

docker run -it \
  --log-driver gelf \
  --log-opt gelf-address=udp://127.0.0.1:12201 \
  --log-opt tag=some-app \
  --log-opt env=staging \
  --log-opt labels=staging \
  ubuntu:16.04 /bin/bash -c 'echo Hello World'

I'd like to use the env value that I passed in my logstash config as such:

input {
  gelf { }
}

output {
  elasticsearch {
    hosts => ["http://127.0.0.1:9200"]
    index => "logstash-%{env-value-here}-%{tag}-%{+YYYY.MM.dd}"
  }
}

There seems to be another question about env/labels with Graylog: Docker GELF driver env option

Answer 1

After reading the PR that added this option, I realised that I misunderstood how it was supposed to work.

--log-opt labels=a,b,c (same with env) define keys to include in the GELF event. The values are actually retrieved from docker labels and environment variables respectively.

--log-opt labels=foo --label foo=bar will include foo: bar in the event.