Document toolboxDocument toolbox

box.docker

Introduction

The tags beginning with box.docker identify events generated by Docker.

Valid tags and data tables 

The full tag must have 3 levels. The first two are fixed as box.docker. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

Docker container logs

box.docker.stats

box.docker.stats

For more information, read more About Devo tags.

Table structure

These are the fields displayed in this table:

box.docker.stats

Field

Type

Field transformation

Source field name

Extra fields

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

ContainerID

str

 

vcontainerid

 

ContainerName

str

 

vcontainername

 

CPUPercentage

float8

 

 

 

RAMusedGB

float8

(upper(RAMused2) -> 'MIB') ? float8(split(upper(RAMused2), "MIB")[0]) / 953.674 : (upper(RAMused2) -> 'KIB') ? float8(split(upper(RAMused2), "KIB")[0]) / 976563 : (upper(RAMused2) -> 'GIB') ? float8(split(upper(RAMused2), "GIB")[0]) / 1.07374 : (upper(RAMused2) -> 'MB') ? float8(split(upper(RAMused2), "MB")[0]) / 1024 : (upper(RAMused2) -> 'KB') ? float8(split(upper(RAMused2), "KB")[0]) / 1048576 : (upper(RAMused2) -> 'GB') ? float8(split(upper(RAMused2), "GB")[0]) : null(0.0)

RAMused2

 

RAMavailableGB

float8

(upper(RAMavailable2) -> 'MIB') ? float8(split(upper(RAMavailable2), "MIB")[0]) / 953.674 : (upper(RAMavailable2) -> 'KIB') ? float8(split(upper(RAMavailable2), "KIB")[0]) / 976563 : (upper(RAMavailable2) -> 'GIB') ? float8(split(upper(RAMavailable2), "GIB")[0]) / 1.07374 : (upper(RAMavailable2) -> 'MB') ? float8(split(upper(RAMavailable2), "MB")[0]) / 1024 : (upper(RAMavailable2) -> 'KB') ? float8(split(upper(RAMavailable2), "KB")[0]) / 1048576 : (upper(RAMavailable2) -> 'GB') ? float8(split(upper(RAMavailable2), "GB")[0]) : null(0.0)

RAMavailable2

 

NetInMB

float8

(upper(NetIn2) -> 'MB') ? float8(split(upper(NetIn2), "MB")[0]) * 1 : (upper(NetIn2) -> 'KB') ? float8(split(upper(NetIn2), "KB")[0]) / 1024 : (upper(NetIn2) -> 'GB') ? float8(split(upper(NetIn2), "GB")[0]) * 1024 : (upper(NetIn2) -> 'GIB') ? float8(split(upper(NetIn2), "GIB")[0]) * 1073.74 : (upper(NetIn2) -> 'MIB') ? float8(split(upper(NetIn2), "MIB")[0]) * 1.04858 : (upper(NetIn2) -> 'KIB') ? float8(split(upper(NetIn2), "KIB")[0]) * 0.001024 : (upper(NetIn2) -> 'B') ? float8(split(upper(NetIn2), "B")[0]) / 1048576 : null(0.0)

NetIn2

 

NetOutMB

float8

NetOut2

 

BlocksInMB

float8

BlocksIn2

 

BlocksOutMB

float8

BlocksOut2

 

RamPecentage

float8

 

 

 

PIDs

int4

 

 

 

rawMessage

str

 

rawSource

 

hostchain

str

 

 

✓

tag

str

 

 

✓