I have a docker daemon with default log driver set to syslog and a dozen containers with --log-driver gelf --log-opt gelf-address=udp://192.168.x.x:12201 where 192.168.x.x:12201 is logstash.

Logs from one of containers (and only one specific contrainer) end up both in syslog and ELK. Container is started with following command line from systemd:

/usr/bin/docker run --name application --log-driver gelf \
                    --log-opt gelf-address=udp://192.168.x.x:12201 \
                    -p 192.168.x.x:Y:Y \ 
                    -v /mnt/incoming:/mnt/incoming \

The one interesting thing is that in syslog the entries from this container have programname as docker instead of usual container hash.

docker-ce version is 5:18.09.0~3-0~debian-stretch but it had the same behavior before this version too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.