netops-stack/compose-syslog.yaml at main · pamosima/netops-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# Optional overlay: syslog ingestion via Vector → ClickHouse (ClickStack).
# Requires compose-clickstack.yaml (ClickHouse must be running).
# Usage:
#   docker compose -f compose.yaml -f compose-clickstack.yaml -f compose-syslog.yaml up -d
#
# Devices send syslog to this host on UDP 514 (e.g. logging host 198.18.134.22).
# Table default.syslog is created on first run via clickstack-syslog-init.
networks:
  gnp-mgmt:
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.60.0/24

services:
  # One-off: create default.syslog table in ClickStack's ClickHouse
  clickstack-syslog-init:
    image: clickhouse/clickhouse-server:24.8
    container_name: netops-stack-clickstack-syslog-init
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        sleep 5
        clickhouse-client --host netops-stack-clickstack < /init/syslog.sql
        echo "syslog table ready"
    volumes:
      - ./clickhouse/init/syslog.sql:/init/syslog.sql:ro
    depends_on:
      - clickstack
    networks:
      - gnp-mgmt
    restart: "no"

  vector:
    image: timberio/vector:0.38.0-debian
    container_name: netops-stack-vector
    volumes:
      - ./vector/vector.toml:/etc/vector/vector.toml:ro
    command: ["--config", "/etc/vector/vector.toml"]
    ports:
      - "514:514/udp"
    depends_on:
      clickstack-syslog-init:
        condition: service_completed_successfully
    restart: unless-stopped
    networks:
      - gnp-mgmt