Docker Logging Drivers

A logging driver is a pluggable framework for accessing log data from Docker services and containers.

Default Logging Driver

Set the default logging driver in the “/etc/docker/deamon.json” with the “log-driver” and “log-opts“.

• local
  • captures output from container’s stdout/stderr and writes them to an internal file-based storage

• json-file
  • captures output from container’s stdout/stderr and writes them using JSON format
• journald
  • sends container logs to the system journal. Logs can be retrieved using the “journalctl” command.
• splunk
  • sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud.

{
  "log-driver": "local",
  "log-opts": {
    "max-size": "10m"
  }
}

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "labels": "production_status",
    "env": "os,customer"
  }
}

{
  "log-driver": "journald"
}

{
  "log-driver": "splunk",
  "log-opts": {
    "splunk-token": "",
    "splunk-url": "",
    ...
  }
}

Overriding Logging Driver

You can override the default logging driver for each container by using the “docker run” command with the –log-driver and –log-opt flags.