Skip to content
Search

Logspout

lastmod 2021-03-02created 2021-02-267 edits

Logspout is a log router for Docker containers that runs inside Docker. It attaches to all containers on a host, then routes their logs to a destination. It acts as a non-intrusive agent on each Docker instance, collecting logs from each running daemon.

Categories

Using logspout

Route all container output to remote syslog

The simplest way to use logspout is to just take all logs and ship to a remote syslog. Just pass a syslog URI (or several comma separated URIs) as the command. Here we show use of the tls encrypted transport option in the URI. Also, we always mount the Docker Unix socket with -v to /var/run/docker.sock: 

$ docker run --name="logspout" \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout \
    syslog+tls://logs.papertrailapp.com:55555

Ignoring specific containers

You can tell logspout to ignore specific containers by setting an environment variable when starting your container, like so:- 

$ docker run -d -e 'LOGSPOUT=ignore' image

Or, by adding a label which you define by setting an environment variable when running logspout: 

$ docker run --name="logspout" \
    -e EXCLUDE_LABEL=logspout.exclude \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout
$ docker run -d --label logspout.exclude=true image

Logspout also allows to ignore containers by specifying a list of labels using the environment variables EXCLUDE_LABELS or EXCLUDE_LABEL, using the ; as separator: 

$ docker run --name="logspout" \
    -e EXCLUDE_LABELS=k8s:app;backend:rails;io.kubernetes.pod.namespace:default \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout
$ docker run -d --label k8s=app image1
$ docker run -d --label backend=rails image2

NOTE Setting EXCLUDE_LABELS would take precedence over setting EXCLUDE_LABEL

Including specific containers

You can tell logspout to only include certain containers by setting filter parameters on the URI: 

$ docker run \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout \
    raw://192.168.10.10:5000?filter.name=*_db

$ docker run \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout \
    raw://192.168.10.10:5000?filter.id=3b6ba57db54a

$ docker run \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout \
    raw://192.168.10.10:5000?filter.sources=stdout%2Cstderr

# Forward logs from containers with both label 'a' starting with 'x', and label 'b' ending in 'y'.
$ docker run \
    --volume=/var/run/docker.sock:/var/run/docker.sock \
    gliderlabs/logspout \
    raw://192.168.10.10:5000?filter.labels=a:x*%2Cb:*y

See also

Favorite site

author Zer0 sitemap