how to make fail2ban read json docker logs

Question

Is it possible to configure my fail2ban jail.conf to inspect the docker logs instead of mounting the log in the host. for example to set the logpath to the path of the log of the container.

Jail.conf:

...
#example
[nginx-http-auth]
    enabled = true
    filter  = nginx-http-auth
    port    = http,https
    logpath = /var/lib/docker/containers/819564257d4*/*e0923e-json.log
...

but this doesn't do much, because there is a little difference between the docker logs command and the log file:

# docker logs @nginx_container_name

2016/03/23 12:39:52 [error] 6#6: *350 upstream prematurely closed connection while reading response header from upstream, client: @ATTACKER_IP, server: @MY_DNS, request: "GET /Blog/wp-login.php HTTP/1.1", upstream: "http://172.17.0.3:8001/Blog/wp-login.php", host: "@MY_IP:80" @ATTACKER_IP - - [23/Mar/2016:12:39:52 +0000] "GET /Blog/wp-login.php HTTP/1.1" 502 173 "-" "Python-urllib/2.7"

# cat /var/lib/docker/containers/819564257d4*/*e0923e-json.log

{"log":"2016/03/23 12:39:52 [error] 6#6: *350 upstream prematurely closed connection while reading response header from upstream, client: @ATTACKER_IP, server: @MY_DNS, request: "GET /Blog/wp-login.php HTTP/1.1", upstream: "http://172.17.0.3:8001/Blog/wp-login.php", host: "@MY_IP:80" ","stream":"stdout","time":"2016-03-23T12:39:52.219982304Z"} {"log":"@ATTACKER_IP - - [23/Mar/2016:12:39:52 +0000] "GET /Blog/wp-login.php HTTP/1.1" 502 173 "-" "Python-urllib/2.7" ","stream":"stdout","time":"2016-03-23T12:39:52.421767592Z"}

I'm accually mounting the log file into the host and I know that this is stupid, so my question is :

is there any way to make the rsyslog read the json log file of the docker nginx container
if not, how to configure docker to make a syslog log format
if not , how to configure syslog on the container in order to pass the log to my host ?

Thanks !

how to make fail2ban read json docker logs

2 Answers