Explore documentation

Better Stack Amazon ECS logging

Start logging in 5 minutes

Send logs to Better Stack from your AWS ECS cluster using FireLens and Fluent Bit.

Set up log forwarding

Add Fluent Bit sidecar to your ECS task.

Log into the AWS Console and search Elastic Container Service.
Click Task definitions in the sidebar.
Select your task definition and revision.
Click Create a new revision with JSON button.
Add Fluent Bit log router container to your task definition:

Task definition

Copied!

{
    "family": "your_ecs_task",
    "containerDefinitions": [
        {
            "name": "your_app",
            ... Put your ECS app configuration here
            "essential": true,
            "logConfiguration": {
                "logDriver": "awsfirelens"
            }
        },
        {
            "name": "log_router",
            "image": "betterstack/aws-ecs-fluent-bit:amd64-latest", 
            "cpu": 256,
            "memory": 512,
            "memoryReservation": 50,
            "essential": true,
            "environment": [
                {
                    "name": "BETTER_STACK_SOURCE_TOKEN",
                    "value": "$SOURCE_TOKEN"
                },
                {
                    "name": "BETTER_STACK_INGESTING_HOST",
                    "value": "$INGESTING_HOST"
                },
                {
                    "name": "BETTER_STACK_COMPRESS",
                    "value": "gzip"
                }
            ],
            "firelensConfiguration": {
                "type": "fluentbit",
                "options": {
                    "config-file-type": "file",
                    "config-file-value": "/fluent-bit-logtail.conf",
                    "enable-ecs-log-metadata": "true"
                }
            }
        }
    ],
    "networkMode": "host",
    ... Put your ECS task configuration here
}

Using ARM-based instances?

Use ARM log router image: betterstack/aws-ecs-fluent-bit:arm64-latest.

Deploy your task and you should see your logs in Better Stack → Live tail.

The latest images run Fluent Bit 1.9 on Amazon Linux 2. For Fluent Bit 5 on Amazon Linux 2023, use betterstack/aws-ecs-fluent-bit:amd64-3 or arm64-3 instead.

Stack traces or long lines split into several logs?

Set BETTER_STACK_MULTILINE_PARSER in the log_router environment to java, python or go to keep each stack trace in one log, or to several parsers separated by commas, such as java,python. The Fluent Bit 5 -3 images also accept ruby and json. Set it to partial_message instead to join long lines that Docker splits at 16 kB.

Run the log router as a non-root user

Add "user": "10001:10001", or any uid no other container uses, and "readonlyRootFilesystem": true to the log_router container to meet AWS Security Hub controls ECS.20 and ECS.5. It needs ECS agent 1.96.0 or later.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

Additional information

Want to read about ECS logging and FireLens configuration in more detail?
Check out the Amazon ECS Custom log routing docs page.

Better Stack Kubernetes logging

Better Stack Dokku logging