(@aws-cdk/aws-ecs): SplunkLogDriver in Fargate PV 1.4 does not respect 'tag', but 'splunk-tag' instead

[bweigel]

In Fargate platform version 1.4 the Docker engine was replaced by containerd.
This results in a different behavior and setting tag in SplunkLogDriverProps will not yield the expected result.

Instead the new logging implementation in PV 1.4 expects splunk-tag, as outlined by my correpondence with the AWS support:

Diving deeper into the Fargate 1.4 Platform version, a change was made in the backend logging architecture which replaces Docker Engine with Containerd as Fargate’s container execution engine. I'm including a document for your review, which is linked in the resources section, below [1].

In the Github page for the new shim loggers, support for the Splunk log driver tag is mentioned in the README file. Interestingly, the syntax appears to have changed for the Containerd logging option. I am providing this link for you, as well [2].

Instead of using "tag": "", Containerd is expecting "splunk-tag": "".
...
[1] https://aws.amazon.com/blogs/containers/under-the-hood-fargate-data-plane : Under the Hood - Fargate Data Plane
[2] https://github.com/aws/amazon-ecs-shim-loggers-for-containerd : AWS ECS Shim Loggers for Containerd

I have not verified that this works, however I thought it reasonable to open an issue in case anyone else has this problem.

Reproduction Steps

I don't have a minimal example as of now, bur pretty much anyone using

new ecs.SplunkLogDriver({
      tag: '',
      ...
    });

will have noticed a difference in behavior, when the Fargate-PV-tag LATEST was rolled up to 1.4 these past weeks.

What did you expect to happen?

No Docker container id in my Splunk log-messages, when setting tag: '' (empty string).

What actually happened?

Docker container id in my Splunk log-messages.

Environment

• CDK CLI Version : 1.95.1
• Framework Version: 1.95.1
• Node.js Version: 15.11.0
• OS : Manjaro Linux
• Language (Version): Typescript 3.9.9

Comment

Don't know if this is a bug per se in the CDK, bc the behavior is as expected.

Also I can try and fix/implement this, probably starting here with something pragmatic?

@aws-cdk/aws-ecs/lib/log-drivers/base-log-driver.ts#L2-L9

aws-cdk/packages/@aws-cdk/aws-ecs/lib/log-drivers/splunk-log-driver.ts

Lines 132 to 148 in 7966f8d

	public bind(_scope: CoreConstruct, _containerDefinition: ContainerDefinition): LogDriverConfig {
	return {
	logDriver: 'splunk',
	options: stringifyOptions({
	'splunk-token': this.props.token,
	'splunk-url': this.props.url,
	'splunk-source': this.props.source,
	'splunk-sourcetype': this.props.sourceType,
	'splunk-index': this.props.index,
	'splunk-capath': this.props.caPath,
	'splunk-caname': this.props.caName,
	'splunk-insecureskipverify': this.props.insecureSkipVerify,
	'splunk-format': this.props.format,
	'splunk-verify-connection': this.props.verifyConnection,
	'splunk-gzip': this.props.gzip,
	'splunk-gzip-level': this.props.gzipLevel,
	...renderCommonLogDriverOptions(this.props),

What do you think?

---

This is 🐛 Bug Report

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.