Docker image for centralized logging based on CentOS 7 with rsyslog, elasticsearch and kibana.

Contains several pre-configured dashboards for freeIPA server - User Logins, IPA Server Administration, IPA Server Health, IPA Server Utilization and SSSD. Screencast is available on youtube. For more information about this effort and how to configure FreeIPA servers and clients to send proper logs to this container, visit this page.

To get this image, pull it from docker hub:

$ docker pull pschiffe/rsyslog-elasticsearch-kibana

Or, if you want to build this image yourself, clone the github repo and in directory with Dockerfile run:

$ docker build -t <username>/rsyslog-elasticsearch-kibana .

To run the image use:

$ docker run -d -p 514:514 -p 514:514/udp -p 5601:5601 -v /etc/localtime:/etc/localtime:ro pschiffe/rsyslog-elasticsearch-kibana

Rsyslog listens on standard port 514 (both TCP and UDP) and kibana on TCP port 5601. To forward log messages from your system, configure rsyslog according to this recipe with appropriate address of running container. To test the running container from the host system you can use:

$ logger -n localhost 'log message from host'

Kibana is available via regular web browser on http:https://localhost:5601 address from the host system. Please note, that it can take up to 10 seconds for container to be ready after start.

Elasticsearch is storing data in docker data volume /var/lib/elasticsearch.