Amazon ECS

This setup adapts Papertrail’s Docker logspout instructions for Amazon ECS. Logspout is a lightweight log router for Docker.

Setup

Use the information below to create a new task definition in the Amazon ECS console with a unique name, such as logspout. See Creating a task definition in the Amazon AWS Documentation for more information.

Add a volume to your task definition with a unique name, such as dockersock. Enter /var/run/docker.sock as the Volume’s Source path.
Add a new container definition with the following details defined:

Provide a unique container name, such as logspout.
For Image, enter gliderlabs/logspout:latest.
When you configure the ENVIRONMENT, enter syslog+tls://logsN.papertrailapp.com:XXXXX as the Command value, replacing logsN and XXXXX with your log destination’s URL and port, accessible in the Papertrail log destination.
When defining the mount points for the storage and logging locations, select the docker socket volume name as the Source volume, and enter /var/run/docker.sock as the Container path.

Use the information below to create a new service for the newly created task definition in the Amazon ECS console. See Creating an Amazon ECS service in the Amazon AWS Documentation for more information.

Fill in the service fields, with Number of Tasks being equivalent to the number of instances in the cluster. Provide a name (such as logspout) and other values based on the desired cluster setup.
Select One Task per Host for Placement Templates. This sets up one logspout container per instance, to prevent log duplication.

There will now be logspout containers running on each host, ready to accept logs from your other containers and send them to Papertrail.

For each container that should log through logspout, edit the container’s task definition with the following:

Create a new revision for the container.
When defining the storage and logging location for the log configuration, set the Log driver to either json-file or journald.

Once the services are updated, visit the Event viewer to see logs come in.