Any good how-to articles on how to get OpenObserve up and running on a Pi using Docker?

[virtualistic]

I've read that it should be possible to get OpenObserve up and running on a Pi (4 in my case) with Docker. Is there any good "dummy" proof documentation out there on how do get this done?

[hengfeiyang]

i have no Pi for test, but someone mentioned they can directly run openobserve/openobserve:v0.8.0 in docker, can you try?

[virtualistic]

Thank you @hengfeiyang ! That seems to work. I tried the latest versions but they won't work on a Pi running Docker. (hopefully going forward new versions are also made ready to run on a Pi with Docker) 🙏
The whole reason I wanted to dig into OpenObserve was to get a place to syslog my hardware (HP Switches and some Aruba wifi APs)
Good news is that using this docker-compose.yaml, O2 will be up and running on a Pi4 using Docker:

 services:
  openobserve:
    image: public.ecr.aws/zinclabs/openobserve:v0.8.0
    restart: no
    environment:
      ZO_ROOT_USER_EMAIL: "[email protected]"
      ZO_ROOT_USER_PASSWORD: "Complexpass#123"
    ports:
    - protocol: udp
      published: 514
      target: 5514
    - protocol: tcp
      published: 514
      target: 5514
    - protocol: tcp
      published: 5080
      target: 5080
    volumes:
      - /home/pi/docker/openobserve/data:/data
volumes:
  data:

You can then in OpenObserve enable syslog, set a route so that data gets ingested.
Weird thing is that syslog doesn't seem to "populate" the data it's being sent from the APs.
A sample syslog-ng docker instance I also have running ingests data from the AP like so in a log-file:
Feb 25 19:22:38 wifi-kantoor cli[4813]: <541004> <WARN> AP:wifi-office <192.168.10.71 80:8D:B7:C9:00:00> recv_sta_update: receive station msg, mac-36:f6:ef:ac:00:00 bssid-80:8d:b7:18:00:00 essid-my-ssid timestamp-1708885358-726240.

In OpenObserve the data is presented like so: (setting the year as the hostname:)

The syslog test script (syslog_log_generator) does seem to provide better data that O2 understands:

Don't know if there is anything I can do so data is represented with the right fields.
Is there any difference between using Syslog, or Syslog-NG (the documentation only mentions Syslog:
https://openobserve.ai/docs/ingestion/logs/syslog/#enable-syslog

while the GUI also has Syslog-NG but I can't find how to configure it when using the Docker image without using axoflow

[prabhatsharma]

If you can, then use syslog-ng to send data to OpenObserve. syslog has too many gotchas and not all of them are covered by OpenObserve.

[prabhatsharma]

You don't need axoflow. The documentation link is for open source syslog-ng where support for OpenObserve was introduced in v4.5 of syslog-ng

[virtualistic]

@prabhatsharma I would rather use Syslog-NG to process the incoming data instead of syslog but I would probably need to configure syslog-ng to listen on port 5514 for example using the syslog-ng.conf but I haven't found out how this needs to be configured since the syslog-ng.conf file cannot be edited from inside O2 🤔