Docker Logs (Beta)
Stream Docker event logs directly to Panther over HTTPS
Overview
Docker log ingestion is in open beta starting with Panther version 1.77, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther supports ingesting Docker event logs by streaming them to an HTTP Source after they are forwarded with Fluent Bit.
How to onboard Docker Events to Panther
Step 1: Create a new Docker Events log source in Panther
In the left-side navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for "Docker Events," then click its tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the HTTP option.
Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.
When setting the Auth method for the source, we recommend using Shared Secret.
Payloads sent to this source are subject to the payload requirements for all HTTP sources.
Do not proceed to the next step until the creation of your HTTP endpoint has completed.
After creating the HTTP source, the Panther Console will display your HTTP Source URL. Store this value in a secure location, as you will need it in the next steps.
Step 2: Configure Fluent Bit
Follow the Getting Started with Fluent Bit instructions to install Fluent Bit as a service.
Create a Fluent Bit configuration file.
See sample configuration files for Linux and macOS below under Example configuration files.
Start Fluent Bit, passing the path to your new configuration file.
You must include the path to a
parser.conf
file that contains thedocker
parser. This is included by fluent-bit by default. On Linux, it can be found at/etc/fluent-bit/parsers.conf
.Example:
fluent-bit -c fluentbit.conf -R /etc/fluent-bit/parsers.conf
Example configuration files
Configure the following in your Fluent Bit configuration file:
[INPUT]
variables:Name: Set this to
docker_events
.Parser: Set this to
docker
.
[OUTPUT]
variables:Host: Enter your Panther URL.
Example:
logs.instance-name.runpanther.net
URI: Enter the end of the HTTP Source ingest URL (generated in Step 1 of this process), starting with
/http/
.Example:
/http/cb015ee4-543c-4489-9f4b-testaa16d7a
Header: Enter the header name you created and the secret you generated while configuring your HTTP source in the Panther Console in Step 1.
Name: Set to
http
.TLS: Set to
ON
.Port: Set to
443
.
Supported log types
Docker.Events
The following defines the Docker events log schema:
Last updated