Adding PostgreSQL Logs to Unified Logging

PostgreSQL server

In the PostgreSQL configuration ( postgresql.conf ), add syslog in the log destination:

 log_destination = 'stderr,csvlog,syslog' 

In the rsyslog configuration ( /etc/rsyslog.conf ), add the following line:

 local0.* @@<enterprise-elk_hostname>:10514 

ELK server

In the fluentd configuration ( enterprise-unified-logging/fluentd/files_docker/fluent.conf ), uncomment the following block:

<source>  
  @type syslog  
  tag postgresql  
  protocol_type tcp  
  bind 0.0.0.0  
  port 10514  
</source> 

and add a block that will match your postgresql tag. example:

<match postgresql.*.*>  
  @type copy  
  <store>  
    @type elasticsearch  
    host elasticsearch  
    port 9200  
    logstash_format true  
    logstash_prefix postgresql  
    time_key_format "%FT%T.%L%z"  
    buffer_chunk_limit 8m  
    buffer_queue_limit 64  
    flush_interval 5s  
  </store>  
</match> 

In the docker-compose make sure to forward the port 10514 in to the fluentd service by adding the following line:

 ports:  
 - "10514:10514"