Docker logs

The Docker Logs source collects stdout and stderr logs from containers managed by the Docker daemon. It continuously streams container logs and emits them as log events into the telemetry pipeline for further processing, filtering, and routing.

This source is commonly used in on-prem, self-managed, and containerized environments where Docker is the primary container runtime.

This source was previously named docker. Existing configurations must be updated to use the new source type name.

Failing to update the source type may result in configuration errors during startup.

The Docker Logs source requires access to the Docker daemon.

The user running worker must:

Without sufficient permissions, the source will fail to initialize.

When worker itself is deployed as a Docker container, the source automatically attempts to avoid collecting its own logs.

This is done by comparing the container hostname with container IDs. If a match is detected, that container is excluded from log collection.

If the container hostname is manually changed, this automatic exclusion may no longer work. In such cases, the worker container should be explicitly excluded using container filtering options.

The source connects to the Docker daemon and streams logs from running containers in real time.

Logs are:

Because acknowledgements are not supported, delivery guarantees depend on downstream pipeline components.

Defines the Docker daemon endpoint to connect to.

If not explicitly configured:

Using an HTTPS endpoint enables encrypted communication with the Docker daemon.

Restricts log collection to a specific set of containers identified by container ID or name.

Prefix matching is applied, meaning partial names or IDs may match multiple containers.

Excludes specific containers from log collection based on container ID or name.

Exclusions always take precedence over inclusions. If a container matches both include and exclude rules, it is excluded.

Care should be taken when using prefix-based exclusions, as they cannot be overridden.

Limits log collection to containers created from specific Docker images.

If not configured, logs from all images are collected.

Filters containers based on Docker object labels.

Only containers matching the specified label selectors are included in log collection.

Overrides the field name used to attach the host name to each log event.

If not set, the globally configured log schema host key is used.

Controls automatic merging of partial log events produced by Docker.

When enabled:

When disabled:

Defines the log field used to mark an event as partial when automatic merging is disabled.

This field allows downstream systems to identify incomplete log messages.

Enables aggregation of multiple log lines into a single logical event.

This is commonly required for:

Multiline aggregation is disabled by default.

Multiline behavior is controlled through pattern matching and aggregation modes, determining:

Timeouts ensure that incomplete messages are eventually emitted even if no new lines arrive.

Defines how long the source waits before retrying after encountering a connection or read error when communicating with the Docker daemon.

Configures TLS settings when connecting to the Docker daemon over HTTPS.

If TLS settings are not explicitly provided, Docker’s standard certificate resolution mechanism is used via environment variables and default paths.

TLS configuration ensures secure communication when accessing remote Docker daemons.