Coldfusion log parse in Azure Log Analytics Workspace

[Souvik Saha Choudhury]

I created an Azure Container Instance and Coldfusion 2021 is running on it as a Docker image.

The application creates multiple log files. I sent all these logs to Standard Output by the symlink.

Now, I want to parse these logs file-wise in Azure Log Analytics Workspace.

Can anyone help me?

Thanks!

[Charlie Arehart]

I don't see that there's anything cf-specific about this. With the cf logs symlinked to docker logs (or kubectl logs), your question would seem to be how to have a container in Azure route its logs to alaw. There are such generic docs at ms, such as if you use aks:

https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-enable-existing-c...

If somehow that doesn't suit, please clarify a) which of the dozens of ways to run a container on Azure are you using, and b) are you really looking for help getting them INTO alaw, or some other aspect of "parsing" them? Have you already considered the dcr vs ingestion-time rules options, such as are discussed here:

https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview

(To be clear, I have not yet myself used any of these, though it sounds a lot like an ms-packaged implementation of loki and logql, which I am more familiar with.) 

[Souvik Saha Choudhury]

I am running the container in Azure Container Instance.

I also send Coldfusion custom logs to stdout and it's showing in alaw.

Now I want to parse logs file-wise in alaw but I am unable to do so as all logs are showing there. 

[Charlie Arehart]

Again,  nothing specific to cf here, nor really to aci. First, genericslly, if you symlink the cf "custom" logs to stdout, you WILL lose any way to distinguish them. If that distinction matters, you can't use that approach.

Instead, now you're looking at how (generically, with any container) you can get a containers "custom" logs to be fed to some logging solution (like LAW). And the most common solution (generically) is to adopt the sidecar pattern, where you run a other container alongside your cf container to watch its logs and send them elsewhere. Since they are in the same pod, the sidecar can see the logs in the cf (or whatever) container.

And again there's are many such logging sidecar and server solutions. One that is specific to LAW (and shows using it with ECS) is this one :

https://github.com/yangl900/log2oms

Check it out and let us know how it goes. Other Azure resources that may be useful are :

"Collect text logs with Log Analytics agent in Azure Monitor - Azure Monitor | Microsoft Docs" https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs

"Azure Monitor HTTP Data Collector API - Azure Monitor | Microsoft Docs" https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api

[Souvik Saha Choudhury]

@Charlie Arehart Thank you.

I used Data Collector API for different log files.