Configure logging drivers

Docker includes multiple logging mechanisms to help you get information from running containers and services. These mechanisms are called logging drivers.

Each Docker daemon has a default logging driver, which each container uses unless you configure it to use a different logging driver.

Configure the default logging driver for the Docker daemon

To configure the Docker daemon to default to a specific logging driver, use the --log-driver=<VALUE> flag. If the logging driver has configurable options, you can set them using one or more instances of the --log-opt <NAME>=<VALUE> flag.

If you do not specify a logging driver, the default is json-file. Thus, the default output for commands such as docker inspect <CONTAINER> is JSON.

To find the current default logging driver for the Docker daemon, run docker info and search for Logging Driver. You can use the following command on Linux or macOS:

$ docker info |grep 'Logging Driver'

Logging Driver: json-file

Configure the logging driver for a container

When you start a container, you can configure it to use a different logging driver than the Docker daemon’s default. If the logging driver has configurable options, you can set them using one or more instances of the --log-opt <NAME>-<VALUE> flag. Even if the container uses the default logging driver, it can use different configurable options.

To find the current logging driver for a running container, if the daemon is using the json-file logging driver, run the following docker inspect command, substituting the container name or ID for <CONTAINER>:

$ docker inspect -f '{{.HostConfig.LogConfig.Type}}' <CONTAINER>

json-file

Supported logging drivers

The following logging drivers are supported. See each driver’s section below for its configurable options, if applicable.

Limitations of logging drivers

• The docker logs command is not available for drivers other than json-file and journald.

Examples

Configure the logging driver using labels or environment variables

If your container uses labels or environment variables specified in the Dockerfile or at runtime, some logging drivers can use these labels or environment variables to control logging behavior. If a collision occurs between a label and an environment variable, the environment variable takes precedence.

Specify logging attributes and options when you start the Docker daemon. For example, to manually start the daemon with the json-file driver, and set a label and two environment variables, use the following command:

$ dockerd \
         --log-driver=json-file \
         --log-opt labels=production_status \
         --log-opt env=os,customer

Next, run a container and specify values for the labels or env. For example, you might use this:

$ docker run -dit --label production_status=testing -e os=ubuntu alpine sh

If the logging driver supports it, this adds additional fields to the logging output. The following output is for json-file:

"attrs":{"production_status":"testing","os":"ubuntu"}

none

The none driver disables logging for the Docker daemon (if set on the daemon at start-up) or for an individual container at runtime. It has no options.

Examples

This example starts an alpine container with the none log driver.

$ docker run -it --log-driver none alpine ash

json-file

json-file is the default logging driver, and returns logging output in JSON format.

Options

The json-file logging driver supports the following logging options:

Note: If max-size and max-file are set, docker logs only returns the log lines from the newest log file.

Examples

This example starts an alpine container which can have a maximum of 3 log files no larger than 10 megabytes each.

$ docker run --it --log-opt max-size=10m --log-opt max-file=3 alpine ash

syslog

Options

The following logging options are supported for the syslog logging driver:

Examples

This example sends the container’s logging output to a syslog remote server at 192.168.0.42 on port 123, using the the daemon facility:

$ docker run \
         --log-driver=syslog \
         --log-opt syslog-address=tcp://192.168.0.42:123 \
         --log-opt syslog-facility=daemon \
         alpine ash

This example connects to syslog using TCP+TLS transport and specifies the trust certificate, certificate, and key to use.

$ docker run \
         --log-driver=syslog \
         --log-opt syslog-address=tcp+tls://192.168.0.42:123 \
         --log-opt syslog-tls-ca-cert=syslog-tls-ca-cert=/etc/ca-certificates/custom/ca.pem \
         --log-opt syslog-tls-cert=syslog-tls-ca-cert=/etc/ca-certificates/custom/cert.pem \
         --log-opt syslog-tls-key=syslog-tls-ca-cert=/etc/ca-certificates/custom/key.pem \
         alpine ash

journald

The journald logging driver stores the container id in the journal’s CONTAINER_ID field. For detailed information on working with this logging driver, see the journald logging driver reference documentation.

Options

Examples

$ docker run \
         --log-driver=journald \
         alpine ash

gelf

Options

The gelf logging driver supports the following options:

Examples

This example connects the container to the GELF server running at 192.168.0.42 on port 12201.

$ docker run -dit \
             --log-driver=gelf \
             --log-opt gelf-address=udp://192.168.0.42:12201 \
             alpine sh

fluentd

Options

The fluentd logging driver supports the following options:

Examples

This example logs container output to the Fluentd server running on localhost at port 24224 and prepends the tag docker.<CONTAINER_NAME> to the beginning of each message.

$ docker run -dit \
             --log-driver=fluentd \
             --log-opt fluentd-address=localhost:24224 \
             --log-opt tag="docker.{{.Name}}" \
             alpine sh

For detailed information on working with the fluentd logging driver, see the fluentd logging driver

awslogs

The Amazon Cloudwatch Logs driver is called awslogs.

Options

The awslogs supports the following options:

Examples

This exampe sends the logs to region us-east-1 and uses the log group myLogGroup.

$ docker run \
         --log-driver=awslogs \
         --log-opt awslogs-region=us-east-1 \
         --log-opt awslogs-group=myLogGroup \
         alpine sh

For detailed information on working with this logging driver, see the awslogs logging driver reference documentation.

splunk

The splunk logging driver sends container logs to the HTTP Event Collector in Splunk Enterprise and Splunk Cloud.

Options

The splunk logging driver requires the following options:

The splunk logging driver allows the following options:

Examples

This examples sets several options for the splunk logging driver.

$ docker run \
       --log-driver=splunk \
       --log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 \
       --log-opt splunk-url=https://splunkhost:8088 \
       --log-opt splunk-capath=/path/to/cert/cacert.pem \
       --log-opt splunk-caname=SplunkServerDefaultCert \
       --log-opt tag="{{.Name}}/{{.FullID}}" \
       --log-opt labels=location \
       --log-opt env=TEST \
       --env "TEST=false" \
       --label location=west \
   alpine sh

For detailed information about working with the splunk logging driver, see the Splunk logging driver reference documentation.

etwlogs

Options

The etwlogs logging driver forwards each log message as an ETW event. An ETW listener can then be created to listen for these events. This driver does not accept any options.

Examples

$ docker run \
         --logging-driver=etwlogs \
         alpine sh

The ETW logging driver is only available on Windows. For detailed information about working with this logging driver, see the ETW logging driver reference documentation.

gcplogs

Options

The Google Cloud Platform logging driver (gcplogs) supports the following options:

Examples

This example logs the start command and sets a label and an environment variable, which will be incorporated into the logs if the Docker daemon was started with the appropriate --log-opt options.

$ docker run --log-driver=gcplogs \
    --log-opt gcp-log-cmd=true \
    --env "TEST=false" \
    --label location=west \
    your/application \

For detailed information about working with the Google Cloud logging driver, see the Google Cloud Logging driver. reference documentation.

NATS logging options

The NATS logging driver supports the following options:

--log-opt labels=<label1>,<label2>
--log-opt env=<envvar1>,<envvar2>
--log-opt tag=<tag>
--log-opt nats-servers="<comma separated list of nats servers uris>"
--log-opt nats-max-reconnect="<max attempts to connect to a server>"
--log-opt nats-subject="<subject where logs are sent>"
--log-opt nats-tls-ca-cert="<absolute path to cert>"
--log-opt nats-tls-cert="<absolute path to cert>"
--log-opt nats-tls-key="<absolute path to cert>"
--log-opt nats-tls-skip-verify="<value>"

For detailed information, see the NATS logging driver reference documentation.

Feedback? Suggestions? Can't find something in the docs?
Edit this page ● Request docs changes ● Get support
Rate this page: