What approaches and tools do you use for collecting logs from microservice containers?

To collect logs from microservices containers, centralized logging systems are usually used, which allow aggregating, storing, and analyzing logs from multiple containers.

Main approaches:

• Local logging output to stdout/stderr: containers write logs to standard output, which is collected by Docker or Kubernetes.
• Agent on the host: for example, Fluentd, Fluent Bit, Logstash, which collect logs from the host and send them to a centralized storage.
• Sidecar containers: a separate container in the same pod that collects and sends logs.

Popular tools:

• ELK Stack (Elasticsearch, Logstash, Kibana) — for storing, processing, and visualizing logs.
• EFK Stack (Elasticsearch, Fluentd, Kibana) — Fluentd instead of Logstash for lighter collection.
• Promtail + Loki + Grafana — a modern logging solution from Grafana Labs.
• Graylog — a platform for log management.

Example of using Fluent Bit in Kubernetes:

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: logging
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush        1
        Log_Level    info
    [INPUT]
        Name         tail
        Path         /var/log/containers/*.log
        Parser       docker
    [OUTPUT]
        Name         es
        Match        *
        Host         elasticsearch.logging.svc.cluster.local
        Port         9200

Thus, logs from containers are collected by an agent and sent to Elasticsearch for subsequent analysis.