I have elk installed on a container in my stack, and have added it as a linked service to my main application container.
I configured the container log driver to be GELF with the gelf address: udp://elk:5044.
It fails to launch the service and I get this message:
Error response from daemon: Failed to initialize logging driver: gelf: cannot connect to GELF endpoint: elk:5044 dial udp: lookup elk on 8.8.8.8:53: no such host
My elk service is in the same stack, so I think it would be wrong for me to have to name it by an external DNS name (that google would know about).
Why isn’t it picking up the local IP address of the elk server from the service name?
Logging happens in the docker daemon, which doesn’t use Rancher DNS.
OK, I sort of know what that means. Maybe I’ll ask the question behind the question, instead. 
I set up ELK on a container (using a single ELK image) and I’m supposed to get my log data to port 5044 on that container.
I am wading through a myriad of options for doing this, and I could use some direction.
My app logs using bunyan, which means it outputs stringified JSON. I am looking for the best way to get these entries to port 5044 on another container.
There’s a thing called filebeat, which I can’t quite figure out how/where to deploy it. There’s also logspout. I’ve had no success getting either one to get my logs to where they need to go.
I can also modify my app to talk to logstash, but I think it’d be better if that was not done in my node.js process. Something like filebeat, if I can figure it out, seems like the right way to do it.
This stuff seems to be in flux, so I’m looking for direction on what will be worth the time investment.