Docker logs: docker logs, drivers, and events

Unless you configure logging differently, Docker captures container output on STDOUT and STDERR. Read it with docker logs.

Follow logs from a running container:

docker logs -f <container>

Docker Remote API

Example using TLS client certificates:

curl -i --cacert ~/.docker/machine/certs/ca.pem \
    --cert ~/.docker/machine/certs/ca.pem \
    --key ~/.docker/machine/certs/key.pem \
    "https://$(docker-machine ip default):2376/containers/\
    $(docker ps -lq)/logs?stderr=1&stdout=1"

Log drivers

Set the driver with --log-driver on docker run:

• json-file — default; writes JSON log files on the host.
• syslog — send logs to syslog.
• journald — systemd journal.
• gelf — Graylog Extended Log Format.
• fluentd — forward to open_in_new fluentd .
• none — disable logging.

ELK stack

ELK — Elasticsearch, Logstash, and Kibana:

• open_in_new Elasticsearch — near-real-time search; scales across nodes for large log volumes.
• open_in_new Logstash — ingest, parse, and filter logs before indexing or storage.
• open_in_new Kibana — web UI for Elasticsearch queries, charts, and dashboards.

Docker events API

Docker emits events for most container lifecycle steps: create, destroy, die, export, kill, pause, attach, restart, start, stop, unpause.

• die — container process exited.
• destroy — container removed (docker rm).

Watch events:

docker events