Mesosphere Fluentd Filter

Code Climate Test Coverage Gem Version Inline docs Dependency Status

Marathon, Chronos and Mesos combined can allow for teams to build a great solution for deploying and scaling containers. The issue is when you have a system like Kibana it can be hard to identify what container or task a log is coming from.

This filter aims to solve that issue by inspecting containers to inject Mesosphere metatdata into the Fluentd event stream.

What gets injected?


key Description
app The application name in marathon
mesos_framework marathon
mesos_task_id The unique Mesos task id running the docker container


Chronos does not have the idea of an 'application'. Just jobs. We run a lot of jobs that relate to our applications so we use a naming scheme that allows us to extract the marathon application that is running the Chronos task.

An example of a Chronos Job name is the following.


With the default regex in the plugin we extract the following data and inject it into the event stream.

key Description Value
app The application name running the task some-task-app2
mesos_framework chronos chronos
mesos_task_id The unique Mesos task id running the docker container
chronos_task_type The task type our application is running. We run deployment and scheduled tasks. deployTasks


If your using the docker fluentd logging plugin your configuration should look something like this.

  type forward
  port 24224

<filter docker.*>
  type mesosphere-filter
  cache_size 1000
  cache_ttl 3600
  merge_json_log true
  cronos_task_regex (?<app>[a-z0-9]([-a-z0-9]*[a-z0-9]))-(?<date>[^-]+)-(?<time>[^-]+)-(?<task_type>[^-]+)-(?<run>[^-]+)-(?<epoc>[^-]+)

<match docker.*>
  type stdout
key Description Default
cache_size This plugin will cache information from the docker daemon. This configuration determine how large that cache is. 1000
cache_ttl How long to keep items in the cache. 3600
merge_json_log If your application logs in a valid json format, this will merge that into the event stream. true
cronos_task_regex If you don't provide a valid regex here then you will only get the mesos_task id from until you create a standard chronos job name that is parseable by a ruby regex. See example above


We have an application called hello-world. That application is deployed via marathon and has the following environment variables.

key value
MESOS_TASK_ID hello-world.14b0596d-93ea-11e5-a134-124eefe69197
MARATHON_APP_ID /hello-world

Like all great hello world applications. This docker container just execute:

echo '{"say":"Hello World"}'

Without this filter fluentd would process the docker log and output the following.

    "container_id": "ce327cb0de115f7dbfcd2c6055ba945436dada26035a62587b951332a028a530",
    "container_name": "/some_random_meaningless_name",
    "source": "stdout",
    "log": "{\"say\":\"Hello World\"}\r"

With the filter in place that log will become the following.

    "container_id": "ce327cb0de115f7dbfcd2c6055ba945436dada26035a62587b951332a028a530",
    "container_name": "/some_random_meaningless_name",
    "say": "Hello World",
    "mesos_framework": "marathon",
    "app": "hello-world",
    "mesos_task_id": "unquie_task_id",
    "source": "stdout",
    "log": "{\"say\":\"Hello World\"}\r"

So now in Kibana you can filter on many more fields and more easily track down issues when hello-world may be running in multiple containers that are associated with different Mesos tasks.