There is great article how to configure centralized logging for docker with cloudwatch:
It assumes that the application can send logs to other container running rsyslog. We will extend the example to work with locally saved logs. In order to make it work we need to:
1) Create one container that will configure cloudwatch and rsyslog that listen to the events.
2) Configure rsyslog on second devise that will listen to file changes in logs folder and will send logs to second rsyslog service running on another machine
I decided to create another rsyslog agent running together with my application because I’m reusing the docker cloudwatch container.
First lets remove /dev/xconsole from rsyslog config. It breaks the rsyslog because most docker images does not have dev/xconsole. Open aws cloudwatch ecs project and edit Dockerfile
Next we need to configure rsyslog on our app machine. We need rsyslog version > 8.15.0 to use wildcard imfile as a log source(see rsyslog.conf):
1 2 3 4 5 6 7 8 9
supervisord.conf is pretty simply:
1 2 3 4 5 6 7 8
rsyslog.conf sends logs written to file to rsyslog on machine running cloudwatch agent