Log Streaming Setup

ACS can ingest logs from your apps and expose them to agents via get_logs(). There are two approaches: Fluent Bit (for Docker containers) and Direct Integration (for any app).

Option 1: Fluent Bit (Docker — Auto, No Code Changes)

Recommended for Docker services. Fluent Bit reads all Docker container stdout/stderr automatically — zero code changes per app.

Configuration

Add to docker-compose.steward.yml:

fluent-bit:
  image: cr.fluentbit.io/fluent/fluent-bit:3.1
  environment:
    LOG_INGEST_KEY: ${LOG_INGEST_KEY}
  volumes:
    - ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf:ro
    - ./parsers.conf:/fluent-bit/etc/parsers.conf:ro
    - /var/lib/docker/containers:/var/lib/docker/containers:ro
    - /var/run/docker.sock:/var/run/docker.sock:ro

Fluent Bit reads every container's stdout/stderr — no per-app configuration needed.

Verification

Check it's running: docker ps | grep acs_fluent_bit

If logs aren't flowing:

1. Check the container writes to stdout/stderr
2. Check Fluent Bit logs: docker logs acs_fluent_bit
3. Verify log files exist: ls /var/lib/docker/containers/<id>/<id>-json.log

Option 2: Direct Integration (Code-Based — Works Anywhere)

For apps that don't run in Docker (bare metal, VM, serverless). Each app POSTs log entries to ACS.

Endpoint

Send POST to /api/logs/ingest with header X-Log-Ingest-Key: <KEY>

Log Entry Format

POST /api/logs/ingest
X-Log-Ingest-Key: your-log-ingest-key

{
  "message": "Something happened",
  "level": "error",
  "service": "my-app",
  "component": "api/users",
  "metadata": { "action": "create_user", "status": "ok" }
}

Batch Mode

Send multiple entries at once:

{
  "logs": [
    { "message": "Started", "service": "app1", "level": "info" },
    { "message": "DB connected", "service": "app1", "level": "info" }
  ]
}

Querying Logs

Agents can query logs using the get_logs tool:

get_logs(
  service: "my-app",
  level: "error",
  search: "timeout",
  since: "2024-01-01T00:00:00Z",
  limit: 50
)

Parameters:

• service — filter by app/service name
• level — filter by log level (debug, info, warn, error, fatal)
• search — full-text search within log messages
• since — ISO 8601 timestamp, only return logs after this time
• limit — max number of log entries to return

Trade-offs