Outcold Solutions is sponsoring Splunk .conf26 - see you there!

Monitoring Docker

# Splunk field extraction

When you want Splunk to parse fields out of your container logs at search time, target the extraction at the right containers by matching on Collectord’s `source` value. Every container log Collectord forwards carries a structured source that encodes the container ID, container name, image name, and stream:

```text
1/docker/{docker_container_id}/{docker_container_name}/{docker_container_image}.{docker_stream}
```

Use that structure in `props.conf` with wildcards to scope an extraction to a single image, a specific container name, or any combination.

For example, to apply an nginx access-log extraction to every container running the `nginx` image - regardless of container ID, container name, or stream:

```ini
1[source::/docker/*/*/nginx:*]
2EXTRACT-nginx-ingress-controller-http = ^(?P&lt;remote_addr&gt;[^ ]+)\\s+\-\\s+\[(?P&lt;proxy_add_x_forwarded_for&gt;[^"]+)\]\s+\-\s+(?P&lt;remote_user&gt;[^ ]+)\s+\[(?P&lt;time_local&gt;[^"]+)[^"\n]*"(?P&lt;request&gt;[^"]+)"\s+(?P&lt;status&gt;\d+)\s+(?P&lt;body_bytes_sent&gt;\d+)\s+"(?P&lt;http_referer&gt;[^"]+)"\s+"(?P&lt;http_user_agent&gt;[^"]+)"\s+(?P&lt;request_length&gt;\d+)\s+(?P&lt;request_time&gt;[^ ]+)\s+\[(?P&lt;proxy_upstream_name&gt;[^"]+)\]\s+(?P&lt;upstream_addr&gt;[^"]+)\s+(?P&lt;upstream_response_length&gt;\d+)\s+(?P&lt;upstream_response_time&gt;[^ ]+)\s+(?P&lt;upstream_status&gt;\d+)$
```

For a walkthrough using Splunk’s interactive Field Extractor on container logs, see [our blog post](/content/blog/2018-06-20-extracting-fields-from-container-logs/index.html).