What's？

Fluent BitやFluentdを使う時は、設定ファイルでタグを使ったルーティングを書くことになります。

AWS FireLensを使用した場合、タグがどうなるかを確認したい、ということで。

AWS FireLensとFluent Bit／Fluentd

AWS FireLensは、Amazon ECS上で動作するコンテナのログをFluent BitまたはFluentdに送信するログドライバーです。

この仕組みで使うFluent BitおよびFluentdの設定は、タスク定義（のコンテナ定義）より自動生成されます。ですが、それだけでなくカスタムの設定ファイルを含めることができます。

FireLens 設定を使用するタスク定義の作成 / カスタム設定ファイルの指定

ところが、ドキュメントにはルーティングを書くためのタグに関する記述がありません。

GitHub上のAWS FireLensを使ったサンプルを見ても、Matchは*や**になっていることが多く、ここからはルールがわかりません。

Amazon ECS FireLens Examples

唯一、タグのリライトの設定だけ少しだけ具体的な値が出ていますが、それでもルールとしてはハッキリしません。

<match app**>
  @type rewrite_tag_filter

どうしたものでしょうと調べてみると、次のブログにタグの情報が書かれているのを見つけました。「Log Tagging in the generated config file」に記載があります。

Under the hood: FireLens for Amazon ECS Tasks

以下のように書かれています。

Container standard out logs are tagged with <container name>-firelens-<task ID>. So if your container name is app and your Task ID is dcef9dee-d960-4af8-a206-46c31a7f1e67, the tag is app-firelens-dcef9dee-d960-4af8-a206-46c31a7f1e67.

つまり、タグは[コンテナ名]-firelens-[タスクID]になるということですね。

結論はこちらなので、覚えておきましょう。

確認してみる

で、これで終わっても面白くないので、実際のタグを確認してみたいと思います。

カスタム設定ファイルを用意するのは面倒なので、他の方法で…。

ここは、Fluent Bit Plugin for CloudWatch Logsを使いましょう。

Fluent Bit Plugin for CloudWatch Logs

プラグインの設定であるlog_stream_prefixを使えば、ログストリームにタグが入りそうです。

log_stream_prefix: (deprecated) Prefix for the Log Stream name. Setting this to prefix- is the same as setting log_stream_name = prefix-$(tag).

現在のAWS for Fluent Bitのバージョンは2.10.0で、組み込まれているFluent Bit Plugin for CloudWatch Logsのバージョンはv1.6.0です。

こちらのソースコードを見ると、確かにタグが使われそうですね。

		e.stream = output.logStreamPrefix + e.Tag

というわけで、log_stream_prefixを使って確認してみましょう。

なお、log_stream_prefixはdeprecatedと書かれていますが、指定しなかった場合は起動しなくなったのでlog_stream_prefixをそのまま使います…。

2021-02-22T14:08:55.594000+00:00 fluentbit-log-stream/log_router/634a24ad44334f9aa9799f5b4e3257b1 time="2021-02-22T14:08:55Z" level=error msg="log_stream_name or log_stream_prefix is required"

環境

今回の環境は、こちらです。

$ terraform version
Terraform v0.14.7
+ provider registry.terraform.io/hashicorp/aws v3.29.0

AWSのクレデンシャルは、環境変数で設定しているものとします。

$ export AWS_ACCESS_KEY_ID=...
$ export AWS_SECRET_ACCESS_KEY=...
$ export AWS_DEFAULT_REGION=ap-northeast-1

お題

AWS Fargateクラスタを構築し、その中でnginxとFluent Bitのコンテナを動作させます。Fluent BitはAWS FireLensログドライバーとして使い、nginxのログをAmazon CloudWatch Logsへ送信するようにします。

この時の、nginx用に用意したAmazon CloudWatch Logsのログストリーム名を確認します。

環境は、Terraformで構築します。

確認

まずは、必要最低限の部分を抜粋で。
※最後に全体を載せます

タスク定義。

resource "aws_ecs_task_definition" "nginx" {
  family                   = "nginx-task-definition"
  cpu                      = "512"
  memory                   = "1024"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_task_role.arn

  container_definitions = <<JSON
    [
      {
        "name": "log_router",
        "image": "906394416424.dkr.ecr.ap-northeast-1.amazonaws.com/aws-for-fluent-bit:2.10.1",
        "essential": true,
        "firelensConfiguration": {
          "type": "fluentbit"
        },
        "logConfiguration": {
          "logDriver": "awslogs",
          "options": {
            "awslogs-group": "${aws_cloudwatch_log_group.fluentbit.name}",
            "awslogs-region": "ap-northeast-1",
            "awslogs-stream-prefix": "fluentbit-log-stream"
          }
        }
      },
      {
        "name": "nginx",
        "image": "nginx:1.19.7",
        "essential": true,
        "portMappings": [
          {
            "protocol": "tcp",
            "containerPort": 80
          }
        ],
        "logConfiguration": {
          "logDriver": "awsfirelens",
          "options": {
            "Name": "cloudwatch",
            "region": "ap-northeast-1",
            "log_group_name": "${aws_cloudwatch_log_group.nginx.name}",
            "log_stream_prefix": "nginx-log-stream-",
            "auto_create_group": "false"
          }
        }
      }
    ]
      JSON
}

nginxのログは、AWS FireLensを介してAmazon CloudWatch Logsへ送信します。

      {
        "name": "nginx",
        "image": "nginx:1.19.7",
        "essential": true,
        "portMappings": [
          {
            "protocol": "tcp",
            "containerPort": 80
          }
        ],
        "logConfiguration": {
          "logDriver": "awsfirelens",
          "options": {
            "Name": "cloudwatch",
            "region": "ap-northeast-1",
            "log_group_name": "${aws_cloudwatch_log_group.nginx.name}",
            "log_stream_prefix": "nginx-log-stream-",
            "auto_create_group": "false"
          }
        }
      }

log_stream_prefixをnginx-log-stream-と指定したので、ストリーム名はnginx-log-stream-nginx-firelens-[タスクID]となるはずですね。
※ コンテナ名はnginx

nginxのログ出力先ロググループの定義は、こちら。

resource "aws_cloudwatch_log_group" "nginx" {
  name = "/fargate/containers/nginx"
}

applyします。

$ terraform apply

リソース構築後、ロググループをtailしつつ

$ aws logs tail --follow /fargate/containers/nginx

curlでALB越しにnginxにアクセスします。

$ curl [ALBのDNS名]

出力されたログは、こちら。

2021-02-22T15:38:15.159000+00:00 nginx-log-stream-nginx-firelens-6c820b75bc1648c1a7ca4b429c0e2711 {"container_id":"6c820b75bc1648c1a7ca4b429c0e2711-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/6c820b75bc1648c1a7ca4b429c0e2711","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:15 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:17.204000+00:00 nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c {"container_id":"0beffa5df3b445f19fe658e9fdb2663c-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/0beffa5df3b445f19fe658e9fdb2663c","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:17 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:19.249000+00:00 nginx-log-stream-nginx-firelens-6c820b75bc1648c1a7ca4b429c0e2711 {"container_id":"6c820b75bc1648c1a7ca4b429c0e2711-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/6c820b75bc1648c1a7ca4b429c0e2711","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:19 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:21.294000+00:00 nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2 {"container_id":"116c37fd39b84657874faf2eb3a96af2-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/116c37fd39b84657874faf2eb3a96af2","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:21 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:23.345000+00:00 nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c {"container_id":"0beffa5df3b445f19fe658e9fdb2663c-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/0beffa5df3b445f19fe658e9fdb2663c","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:23 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:25.390000+00:00 nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2 {"container_id":"116c37fd39b84657874faf2eb3a96af2-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/116c37fd39b84657874faf2eb3a96af2","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:25 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:27.785000+00:00 nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2 {"container_id":"116c37fd39b84657874faf2eb3a96af2-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/116c37fd39b84657874faf2eb3a96af2","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:27 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"ELB-HealthChecker/2.0\" \"-\"","source":"stdout"}
2021-02-22T15:38:27.785000+00:00 nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c {"container_id":"0beffa5df3b445f19fe658e9fdb2663c-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/0beffa5df3b445f19fe658e9fdb2663c","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:27 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"ELB-HealthChecker/2.0\" \"-\"","source":"stdout"}
2021-02-22T15:38:27.793000+00:00 nginx-log-stream-nginx-firelens-6c820b75bc1648c1a7ca4b429c0e2711 {"container_id":"6c820b75bc1648c1a7ca4b429c0e2711-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/6c820b75bc1648c1a7ca4b429c0e2711","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:27 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"ELB-HealthChecker/2.0\" \"-\"","source":"stdout"}
2021-02-22T15:38:29.475000+00:00 nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c {"container_id":"0beffa5df3b445f19fe658e9fdb2663c-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/0beffa5df3b445f19fe658e9fdb2663c","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:29 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:31.520000+00:00 nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2 {"container_id":"116c37fd39b84657874faf2eb3a96af2-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/116c37fd39b84657874faf2eb3a96af2","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:31 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:33.567000+00:00 nginx-log-stream-nginx-firelens-6c820b75bc1648c1a7ca4b429c0e2711 {"container_id":"6c820b75bc1648c1a7ca4b429c0e2711-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/6c820b75bc1648c1a7ca4b429c0e2711","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:33 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:35.606000+00:00 nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2 {"container_id":"116c37fd39b84657874faf2eb3a96af2-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/116c37fd39b84657874faf2eb3a96af2","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:35 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}
2021-02-22T15:38:37.646000+00:00 nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c {"container_id":"0beffa5df3b445f19fe658e9fdb2663c-2531612879","container_name":"nginx","ecs_cluster":"nginx-cluster","ecs_task_arn":"arn:aws:ecs:ap-northeast-1:[AWSアカウントID]:task/nginx-cluster/0beffa5df3b445f19fe658e9fdb2663c","ecs_task_definition":"nginx-task-definition:15","log":"10.0.10.193 - - [22/Feb/2021:15:38:37 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.68.0\" \"aaa.bbb.ccc.ddd\"","source":"stdout"}

この時のログストリーム名に注目してみましょう。

nginx-log-stream-nginx-firelens-6c820b75bc1648c1a7ca4b429c0e2711
nginx-log-stream-nginx-firelens-0beffa5df3b445f19fe658e9fdb2663c
nginx-log-stream-nginx-firelens-116c37fd39b84657874faf2eb3a96af2

6c820b75bc1648c1a7ca4b429c0e2711、0beffa5df3b445f19fe658e9fdb2663c、116c37fd39b84657874faf2eb3a96af2はタスクIDなので（desired_countは3にしています）、nginx-log-stream-nginx-firelens-[タスクID]（ログストリームprefix＋タグ）というフォーマットになっていますね。

これで、確認ができました。

オマケ

最後に、今回使用したリソース定義全体を載せておきます。

main.tf

terraform {
  required_version = "0.14.7"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "3.29.0"
    }
  }
}

provider "aws" {
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "2.71.0"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  enable_dns_hostnames = true
  enable_dns_support   = true

  azs             = ["ap-northeast-1a", "ap-northeast-1c"]
  public_subnets  = ["10.0.10.0/24", "10.0.20.0/24"]
  private_subnets = ["10.0.30.0/24", "10.0.40.0/24"]

  map_public_ip_on_launch = false

  enable_nat_gateway     = true
  single_nat_gateway     = false
  one_nat_gateway_per_az = false
}

module "load_balancer_sg" {
  source  = "terraform-aws-modules/security-group/aws//modules/http-80"
  version = "3.18.0"

  name   = "load-balancer-sg"
  vpc_id = module.vpc.vpc_id

  ingress_cidr_blocks = ["0.0.0.0/0"]
}

module "nginx_service_sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "3.18.0"

  name   = "nginx-service-sg"
  vpc_id = module.vpc.vpc_id

  ingress_with_cidr_blocks = [
    {
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      description = "nginx-service inbound ports"
      cidr_blocks = "10.0.10.0/24"
    },
    {
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      description = "nginx-service inbound ports"
      cidr_blocks = "10.0.20.0/24"
    }
  ]

  egress_with_cidr_blocks = [
    {
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      description = "nginx-service outbound ports"
      cidr_blocks = "0.0.0.0/0"
    }
  ]
}

module "load_balancer" {
  source  = "terraform-aws-modules/alb/aws"
  version = "5.11.0"

  name = "nginx-alb"

  vpc_id             = module.vpc.vpc_id
  load_balancer_type = "application"
  internal           = false

  subnets         = module.vpc.public_subnets
  security_groups = [module.load_balancer_sg.this_security_group_id]

  target_groups = [
    {
      backend_protocol = "HTTP"
      backend_port     = 80
      target_type      = "ip"

      health_check = {
        interval = 20
      }
    }
  ]

  http_tcp_listeners = [
    {
      port     = 80
      protocol = "HTTP"
    }
  ]
}

locals {
  vpc_id = module.vpc.vpc_id

  private_subnets                = module.vpc.private_subnets
  nginx_service_security_groups  = [module.nginx_service_sg.this_security_group_id]
  load_balancer_target_group_arn = module.load_balancer.target_group_arns[0]

  nginx_simple_container_definition = <<JSON
    [
      {
        "name": "nginx",
        "image": "nginx:1.19.7",
        "essential": true,
        "portMappings": [
          {
            "protocol": "tcp",
            "containerPort": 80
          }
        ],
        "logConfiguration": {
          "logDriver": "awslogs",
          "options": {
            "awslogs-group": "${aws_cloudwatch_log_group.nginx.name}",
            "awslogs-region": "ap-northeast-1",
            "awslogs-stream-prefix": "nginx-log-stream"
          }
        }
      }
    ]
    JSON

  nginx_with_fluentbit_container_definitions = <<JSON
  [
    {
      "name": "log_router",
      "image": "906394416424.dkr.ecr.ap-northeast-1.amazonaws.com/aws-for-fluent-bit:2.10.1",
      "essential": true,
      "firelensConfiguration": {
        "type": "fluentbit",
        "options":{
           "enable-ecs-log-metadata": "true"
        }
      },
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "${aws_cloudwatch_log_group.fluentbit.name}",
          "awslogs-region": "ap-northeast-1",
          "awslogs-stream-prefix": "fluentbit-log-stream"
        }
      }
    },
    {
      "name": "nginx",
      "image": "nginx:1.19.7",
      "essential": true,
      "portMappings": [
        {
          "protocol": "tcp",
          "containerPort": 80
        }
      ],
      "logConfiguration": {
        "logDriver": "awsfirelens",
        "options": {
          "Name": "cloudwatch",
          "region": "ap-northeast-1",
          "log_group_name": "${aws_cloudwatch_log_group.nginx.name}",
          "log_stream_prefix": "nginx-log-stream-",
          "auto_create_group": "false"
        }
      }
    }
  ]
    JSON
}

data "aws_iam_policy_document" "ecs_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy" "ecs_task_execution_role_policy" {
  arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name               = "MyEcsTaskExecutionRole"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy_attachment" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = data.aws_iam_policy.ecs_task_execution_role_policy.arn
}

data "aws_iam_policy_document" "ecs_task_role_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "logs:DescribeLogStreams",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]

    resources = ["*"]
  }
}

resource "aws_iam_policy" "ecs_task_role_policy" {
  name   = "MyEcsTaskPolicy"
  policy = data.aws_iam_policy_document.ecs_task_role_policy_document.json
}

resource "aws_iam_role" "ecs_task_role" {
  name               = "MyEcsTaskRole"
  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_role_policy_attachment" {
  role       = aws_iam_role.ecs_task_role.name
  policy_arn = aws_iam_policy.ecs_task_role_policy.arn
}

resource "aws_cloudwatch_log_group" "nginx" {
  name = "/fargate/containers/nginx"
}

resource "aws_cloudwatch_log_group" "fluentbit" {
  name = "/fargate/containers/fluentbit"
}

resource "aws_ecs_cluster" "nginx" {
  name = "nginx-cluster"
}

resource "aws_ecs_task_definition" "nginx" {
  family       = "nginx-task-definition"
  cpu          = "512"
  memory       = "1024"
  network_mode = "awsvpc"
  requires_compatibilities = [
  "FARGATE"]
  execution_role_arn = aws_iam_role.ecs_task_execution_role.arn
  task_role_arn      = aws_iam_role.ecs_task_role.arn

  # container_definitions = local.nginx_simple_container_definition
  container_definitions = local.nginx_with_fluentbit_container_definitions
}

resource "aws_ecs_service" "nginx" {
  name             = "nginx-service"
  cluster          = aws_ecs_cluster.nginx.arn
  task_definition  = aws_ecs_task_definition.nginx.arn
  desired_count    = 3
  launch_type      = "FARGATE"
  platform_version = "1.4.0"

  deployment_minimum_healthy_percent = 50

  network_configuration {
    assign_public_ip = false
    security_groups  = local.nginx_service_security_groups
    subnets          = local.private_subnets
  }

  load_balancer {
    target_group_arn = local.load_balancer_target_group_arn
    container_name   = "nginx"
    container_port   = 80
  }
}

output "alb_arn" {
  value = module.load_balancer.this_lb_arn
}

output "alb_dns_name" {
  value = module.load_balancer.this_lb_dns_name
}