Configure logging drivers
Estimated reading time: 4 minutesDocker includes multiple logging mechanisms to help you get information from running containers and services. These mechanisms are called logging drivers.
Each Docker daemon has a default logging driver, which each container uses unless you configure it to use a different logging driver.
In addition to using the logging drivers included with Docker, you can also implement and use logging driver plugins. Logging driver plugins are available in Docker 17.05 and higher.
Configure the default logging driver
To configure the Docker daemon to default to a specific logging driver, set the
value of log-driver
to the name of the logging driver in the daemon.json
file, which is located in /etc/docker/
on Linux hosts or
C:\ProgramData\docker\config\
on Windows server hosts. The default logging
driver is json-file
. The following example explicitly sets the default
logging driver to syslog
:
{
"log-driver": "syslog"
}
If the logging driver has configurable options, you can set them in the
daemon.json
file as a JSON array with the key log-opts
. The following
example sets two configurable options on the json-file
logging driver:
{
"log-driver": "json-file",
"log-opts": [
"labels=production_status",
"env=os,customer"
]
}
If you do not specify a logging driver, the default is json-file
. Thus,
the default output for commands such as docker inspect <CONTAINER>
is JSON.
To find the current default logging driver for the Docker daemon, run
docker info
and search for Logging Driver
. You can use the following
command on Linux, macOS, or PowerShell on Windows:
$ docker info |grep 'Logging Driver'
Logging Driver: json-file
Configure the logging driver for a container
When you start a container, you can configure it to use a different logging
driver than the Docker daemon’s default, using the --log-driver
flag. If the
logging driver has configurable options, you can set them using one or more
instances of the --log-opt <NAME>=<VALUE>
flag. Even if the container uses the
default logging driver, it can use different configurable options.
The following example starts an Alpine container with the none
logging driver.
$ docker run -it --log-driver none alpine ash
To find the current logging driver for a running container, if the daemon
is using the json-file
logging driver, run the following docker inspect
command, substituting the container name or ID for <CONTAINER>
:
$ docker inspect -f '{{.HostConfig.LogConfig.Type}}' <CONTAINER>
json-file
Use environment variables or labels with logging drivers
Some logging drivers add the value of a container’s --env|-e
or --label
flags to the container’s logs. This example starts a container using the Docker
daemon’s default logging driver (let’s assume json-file
) but sets the
environment variable os=ubuntu
.
$ docker run -dit --label production_status=testing -e os=ubuntu alpine sh
If the logging driver supports it, this adds additional fields to the logging
output. The following output is generated by the json-file
logging driver:
"attrs":{"production_status":"testing","os":"ubuntu"}
Supported logging drivers
The following logging drivers are supported. See the link to each driver’s documentation for its configurable options, if applicable. If you are using logging driver plugins, you may see more options.
Driver | Description | |
---|---|---|
none | No logs will be available for the container and docker logs will not return any output. | |
json-file | The logs are formatted as JSON. The default logging driver for Docker. | |
syslog | Writes logging messages to the syslog facility. The syslog daemon must be running on the host machine. | |
journald | Writes log messages to journald . The journald daemon must be running on the host machine. | |
gelf | Writes log messages to a Graylog Extended Log Format (GELF) endpoint such as Graylog or Logstash. | |
fluentd | Writes log messages to fluentd (forward input). The fluentd daemon must be running on the host machine. | |
awslogs | Writes log messages to Amazon CloudWatch Logs. | |
splunk | Writes log messages to splunk using the HTTP Event Collector. | |
etwlogs | Writes log messages as Event Tracing for Windows (ETW) events. Only available on Windows platforms. | |
gcplogs | Writes log messages to Google Cloud Platform (GCP) Logging. |
Limitations of logging drivers
The docker logs
command is not available for drivers other than json-file
and journald
.