close icon platform

Discover more from

Personalized news feed, dev communities and search, much better than what’s out there. Maybe ;)

Start reading - Free forever
Start reading - Free forever
Continue reading >

Docker Container Logging Tutorial for Beginners

Docker Container Logging Tutorial for Beginners
Nimrod Kramer
Related tags on
Table of contents


Learn Docker container logging essentials, from setting up logging drivers to implementing best practices for efficient log management and monitoring.

Docker container logging is crucial for monitoring application performance, troubleshooting issues, and ensuring security compliance. This guide covers everything you need to know about setting up and managing logs for your Docker containers.

Key Takeaways

  • Docker logging provides insights into application behavior, enabling troubleshooting and performance optimization
  • Docker supports multiple logging drivers like json-file (default), syslog, fluentd, and more
  • Configure logging drivers and options in daemon.json or when running containers
  • Use docker logs to view container logs, with options for filtering and real-time monitoring
  • Implement centralized logging solutions and the sidecar pattern for efficient log management
  • Follow best practices like standardizing log formats, configuring log rotation, and monitoring log collection

Step-by-Step Guide

  1. Set up Docker logging drivers

    • Edit daemon.json to set the default logging driver and options
    • Or specify a driver when running individual containers using --log-driver
  2. View and manage container logs

    • Use docker logs [CONTAINER] to view logs for a specific container
    • Access log files directly on the host at /var/lib/docker/containers/<CONTAINER>/<CONTAINER>-json.log
    • Configure log file size limits and rotation in daemon.json
  3. Implement centralized logging

    • Use tools like Elastic Stack (ELK) or Fluentd for aggregating logs across containers
    • Adopt the sidecar logging pattern to decouple log handling from applications
  4. Follow best practices

    • Standardize log formats (e.g., JSON) and severity levels across containers
    • Monitor log volume and rate for anomalies and performance issues
    • Use log analysis tools for processing, visualizing, and deriving insights from logs

By following this guide, you'll be able to effectively set up and manage Docker container logging, ensuring your applications are reliable, efficient, and secure.

Getting Ready for Docker Logging


Before you start logging Docker containers, make sure you have the necessary tools and basic knowledge.

Tools and Setup

To get started, you need to have Docker installed on your system. If you haven't already, download and install Docker from the official website. Once installed, verify that Docker is running correctly by checking the version:

docker --version

You should also have a basic understanding of Docker concepts, such as containers, images, and volumes. Familiarize yourself with the Docker CLI and basic commands.

Basic Docker Commands

Here are some essential Docker commands to know:

Command Description
docker run Run a new container from an image
docker ps List all running containers
docker stop Stop a running container
docker logs View logs from a container
docker inspect Display detailed information about a container or image

These commands will come in handy when working with Docker containers and logging. In the next section, we'll explore setting up Docker logging drivers.

Setting Up Docker Logging Drivers

Docker Logging Driver Types

Docker provides several logging drivers to handle container logs in different ways. The main logging drivers are:

Logging Driver Description
json-file Logs are written in JSON format to a file on the host machine. This is the default driver if none is specified.
syslog Logs are sent to a syslog server running on the host or another machine over the network.
journald Logs are sent to the systemd journal on the host machine.
fluentd Logs are forwarded to a Fluentd server running on the host or another machine.
awslogs Logs are sent to Amazon CloudWatch Logs.
splunk Logs are sent to a Splunk HTTP Event Collector.

Setting the Default Logging Driver

To set a default logging driver for all containers on the Docker host, you need to configure it in the Docker daemon settings. Edit the daemon.json file (typically located at /etc/docker/daemon.json on Linux) and set the log-driver option:

  "log-driver": "syslog"

After making the change, restart the Docker daemon for the new settings to take effect.

You can also specify additional options for the logging driver using the log-opts key in the daemon.json file. For example, to set the syslog facility for the syslog driver:

  "log-driver": "syslog",
  "log-opts": {
    "syslog-facility": "local5"

Logging Drivers for Single Containers

If you don't want to change the default logging driver for all containers, you can specify a logging driver for individual containers when running them. Use the --log-driver flag with the docker run command:

docker run --log-driver=fluentd your-image

You can also pass options to the logging driver using the --log-opt flag:

docker run --log-driver=fluentd --log-opt your-image

This allows you to mix different logging drivers across your containers based on your requirements.


Viewing and Managing Container Logs

Using docker logs

The docker logs command is a powerful tool for viewing logs from a running container. Here are some common use cases and options:

Option Description
docker logs [CONTAINER ID/NAME] View logs for a specific container
docker logs --follow [CONTAINER ID/NAME] Follow logs in real-time (similar to tail -f)
docker logs --since=2023-05-15T13:00:00 [CONTAINER ID/NAME] Show logs since a specific time
docker logs --tail=20 [CONTAINER ID/NAME] Show the last N lines of logs
docker logs --details [CONTAINER ID/NAME] Include extra details in logs

Accessing Logs on the Host

Docker stores container logs as JSON files on the host file system by default. The location is /var/lib/docker/containers/<CONTAINER ID>/<CONTAINER ID>-json.log. You can view or tail these log files directly:

# View logs for a container
cat /var/lib/docker/containers/<CONTAINER ID>/<CONTAINER ID>-json.log

# Tail logs for a container 
tail -f /var/lib/docker/containers/<CONTAINER ID>/<CONTAINER ID>-json.log

This can be useful for accessing logs when the container is stopped or for log analysis outside of Docker.

Managing Log File Size and Rotation

To prevent excessive disk usage from log files, you can configure log rotation and file size limits. Edit the daemon.json file and add the following options:

Option Description
max-size Limit the log file size (e.g., 10m for 10MB)
max-file Rotate up to a specified number of log files (e.g., 3)

Here's an example daemon.json configuration:

  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"

Adjust the values based on your requirements and restart the Docker daemon for changes to take effect.

You can also configure log rotation policies for individual containers using the --log-opt flag with docker run.

Best Practices for Docker Logging

Standardizing Log Formats and Levels

To make log management and analysis more efficient, it's essential to standardize log formats and levels across all your Docker containers. Using a structured log format like JSON makes it easier to parse and process log data. Defining consistent log severity levels (e.g., debug, info, warning, error) helps categorize log messages based on their importance.

Centralized Logging Tools

Instead of relying on Docker's default logging drivers, consider using a centralized logging solution. Tools like the Elastic Stack (Elasticsearch, Logstash, Kibana) and Fluentd provide a robust platform for collecting, aggregating, and analyzing logs from multiple containers and hosts.

Centralized Logging Tool Key Features
Elastic Stack (ELK) Elasticsearch for log indexing and searching, Logstash for log collection and processing, Kibana for data visualization and dashboards
Fluentd Unified logging layer for collecting and routing logs, supports various data sources and outputs, highly configurable and scalable

The Sidecar Logging Pattern

The sidecar logging pattern is a popular approach for managing logs in containerized environments, especially in microservices architectures. This pattern involves pairing each application container with a dedicated sidecar container responsible for handling log collection and forwarding.

How it Works:

  1. Application Container: Runs the primary application code and writes logs to a shared volume or stdout/stderr.
  2. Sidecar Logging Container: Mounts the same shared volume as the application container, collects logs from the shared volume or stdout/stderr, and forwards logs to a centralized logging solution.


  • Decouples log management from the application logic
  • Allows customizing log handling per application
  • Enables easier log enrichment and filtering
  • Facilitates log rotation and retention policies

By implementing the sidecar logging pattern, you can effectively manage logs in a scalable and maintainable manner, while keeping your application containers focused on their primary functionality.

Step-by-Step Docker Logging Guide

A practical walkthrough to set up container logging.

Creating a Logged Docker Container

To create a Docker container with specific logging configurations, follow these steps:

1. Create a Dockerfile: Define the base image, copy the application code, and set the logging configuration.

FROM python:3.9-slim


COPY. /app

RUN pip install -r requirements.txt

CMD ["python", ""]

# Set the logging driver to json-file
ENV LOG_DRIVER=json-file

# Set the log level to INFO

2. Build the Docker image: Run docker build -t myapp. to build the Docker image using the Dockerfile.

3. Run the Docker container: Run docker run -d --name myapp myapp to start the Docker container in detached mode.

4. Verify the logging configuration: Check the container logs using docker logs myapp to verify that the logging configuration is set up correctly.

Analyzing Container Logs

Once you have set up container logging, you can analyze the logs to identify issues, debug problems, and optimize performance. Here are some tips for analyzing container logs:

Tip Description
Use docker logs with filters Use docker logs with filters to narrow down the log output to specific containers, dates, or log levels.
Look for error messages Identify error messages and exceptions in the log output to diagnose issues with your application.
Monitor log volume and rate Monitor the log volume and rate to detect anomalies and performance issues.
Use log analysis tools Use log analysis tools like the Elastic Stack or Fluentd to process, analyze, and visualize log data.

By following these steps and tips, you can effectively set up and analyze container logging to improve your application's performance and reliability.


Docker logging is a vital part of managing and monitoring containerized applications. By setting up proper logging practices, you can gain valuable insights into your application's behavior, troubleshoot issues more effectively, and ensure optimal performance and reliability.

Key Takeaways

  • Docker logging is essential for containerized applications
  • Proper logging practices help with troubleshooting and performance optimization
  • Centralized logging tools and the sidecar logging pattern can streamline logging processes

Throughout this tutorial, we've covered the basics of Docker logging, including logging drivers, configuration, and best practices. We've also provided a step-by-step guide to help you set up and analyze container logs.

Final Thoughts

Logging is an ongoing process that requires careful planning and continuous monitoring. As your Docker environment grows and evolves, it's essential to review and adjust your logging strategies to ensure they remain effective and efficient.

By leveraging the power of Docker logging, you can gain better visibility into your containerized applications and ultimately deliver a better user experience.

Remember to experiment with different logging drivers, tools, and techniques to find the approach that best suits your specific needs.


What is the best logging for Docker?

The json-file logging driver is a popular choice for most Docker use cases. It writes logs in JSON format to files on the host machine. This driver is easy to use and doesn't require additional setup or dependencies.

However, for production environments or large-scale deployments, you may want to consider using a more robust logging solution like syslog, fluentd, or a third-party logging service. These options provide better log management, centralized logging, and integration with monitoring tools.

Which logging driver does Docker use?

By default, Docker uses the json-file logging driver. This driver writes container logs in JSON format to files on the host machine. No additional configuration is required to use this driver.

However, Docker supports several other logging drivers out of the box, such as syslog, journald, gelf, fluentd, and awslogs. You can also use third-party logging drivers by installing plugins.

How do I manage Docker container logs?

To manage Docker container logs effectively, follow these best practices:

Best Practice Description
Use a centralized logging solution Send logs to a centralized logging service like Elasticsearch, Splunk, or a cloud-based solution.
Implement log rotation Configure log rotation to prevent log files from consuming too much disk space.
Monitor log collection Ensure that log collection is working correctly by monitoring the logging infrastructure itself.
Use structured logging Adopt structured logging formats like JSON to make it easier to parse and analyze log data programmatically.

How to handle logs in Docker container?

To access and handle logs from Docker containers, use the docker logs command. This command allows you to view logs for a specific container or a group of containers.

For example, to view logs for a container with ID abc123:

docker logs abc123

You can also use flags like -f to follow the logs in real-time or --tail to show only the last few lines.

If you're using a logging driver that doesn't write logs to the container's filesystem (e.g., syslog, fluentd), you'll need to access the logs from the respective logging service or destination.

What are the default logging options in Docker?

The default logging options in Docker are:

Option Default Value
Logging Driver json-file
Log Rotation Disabled
Log Location /var/lib/docker/containers/<container-id>/<container-id>-json.log

With the json-file driver, Docker writes logs in JSON format to files on the host machine, one file per container. No log rotation is performed by default, so log files can grow indefinitely and consume disk space.

You can change the default logging driver and configure log rotation by modifying the Docker daemon configuration file (/etc/docker/daemon.json) or by specifying logging options when running a container.

Related posts

Why not level up your reading with

Stay up-to-date with the latest developer news every time you open a new tab.

Read more