Summary

This chapter taught you how applications such as Splunk can help you monitor and troubleshoot your applications by aggregating your container logs into one central area. We started this chapter with a discussion on the importance of a log management strategy when working with Docker, and then introduced Splunk by discussing its architecture, as well as some of the finer points on how to run the application.

We worked directly with Splunk, running the Docker container image, and started to forward logs from our running system. We then used the Splunk log driver to send our container logs directly to our Splunk container, mounting important directories to make sure our data was saved and available even after we stopped our container from running. Finally, we took a closer look at the Splunk query language, with which we created dashboards and saved searches and considered the advantages of the Splunk app ecosystem.

The next chapter will introduce Docker plugins and teach...