version: '3.3'
services:
  logspout:
    build: ./
    volumes:
      # Logspout reads this in and attaches it to the log
      - /etc/hostname:/etc/host_hostname:ro
      - '/var/run/docker.sock:/tmp/docker.sock'
    environment:
      # IP and port for logstash host
      ROUTE_URIS: "logstash://some.dns:6000"
      # Include all docker labels
      DOCKER_LABELS: "true"
      # Add environment field to all logs sent to logstash
      LOGSTASH_FIELDS: "environment=${NODE_ENV}"
      RETRY_STARTUP: "true"
      RAW_FORMAT: '{ "container" : "{{ .Container.Name }}", "labels": {{ toJSON .Container.Config.Labels }}, "source" : "{{ .Source }}", "message" : {{ toJSON .Data }} }'
    command: 'raw+udp://some.dns:6000'
    deploy:
      mode: global
      resources:
        limits:
          cpus: '0.20'
          memory: 256M
        reservations:
          cpus: '0.10'
          memory: 128M
    restart: on-failure

[2021-06-28T21:18:49,754][WARN ][logstash.outputs.elasticsearch][main][ec5863da584df97e7e09b88e20aac31b53950dfc42b9a358d52a766e775ca61f] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil}, {"@version"=>"1", "type"=>"dockerlog", "container"=>"/logspout_logspout_1", "labels"=>{"com.docker.compose.container-number"=>"1", "com.docker.compose.project.config_files"=>"docker-compose.yaml", "com.docker.compose.version"=>"1.27.4", "com.docker.compose.oneoff"=>"False", "com.docker.compose.service"=>"logspout", "com.docker.compose.project.working_dir"=>"/home/pchost/docker/logspout", "com.docker.compose.config-hash"=>"f4c841a27a87d76eee562fc3329790dd68a1001be5e7c2376ca86313c3d2d21f", "com.docker.compose.project"=>"logspout"}, "@timestamp"=>2021-06-28T21:18:49.591Z, "host"=>"192.168.1.232", "source"=>"stdout", "message"=>"#   ADAPTER\tADDRESS\t\t\tCONTAINERS\tSOURCES\tOPTIONS"}], :response=>{"index"=>{"_index"=>"logstash", "_type"=>"_doc", "_id"=>"s-99VHoB4-ZIuBnPNYth", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [labels.com.docker.compose.project] cannot be changed from type [text] to [ObjectMapper]"}}}}