These docs are for Cribl Stream 4.4 and are no longer actively maintained.

See the latest version (4.11).

Collecting Logs from Amazon ECS Containers

When using the Amazon Elastic Container Service (ECS), Cribl Stream can eliminate the additional expense of CloudWatch Logs by selecting an alternative Docker logging driver.

By default, the awslogs driver will forward all container logs to CloudWatch Logs. This requires an additional Amazon service, such as Kinesis Firehose or Lambda, to export logs to the desired destination.

But by using Docker’s splunk logging driver, you can forward the ECS container logs directly to a Cribl Stream Worker Group, bypassing CloudWatch Logs.

For example, when using Cribl.Cloud, you can forward logs to your Organization’s Splunk HEC endpoint. This endpoint information can be found in your Cloud Organization’s Data Onboarding configuration.

{
    "containerDefinitions": [
        {
            "name": "my-example-container",
            "essential": true,
            "image": "public.ecr.aws/my/containerimage:latest",
            ...
            "logConfiguration": {
                "logDriver": "splunk",
                "options": {
                    "splunk-url": "https://main-default-<org>.cribl.cloud:8088",
                    "splunk-token": "176FCEBF-4CF5-4EDF-91BC-703796522D20",
                    ...
                }
            }
        }
    ],
    ...
}