I have a docker daemon with default log driver set to
syslog and a dozen containers with
--log-driver gelf --log-opt gelf-address=udp://192.168.x.x:12201 where 192.168.x.x:12201 is logstash.
Logs from one of containers (and only one specific contrainer) end up both in syslog and ELK. Container is started with following command line from
/usr/bin/docker run --name application --log-driver gelf \ --log-opt gelf-address=udp://192.168.x.x:12201 \ -p 192.168.x.x:Y:Y \ -v /mnt/incoming:/mnt/incoming \ application
The one interesting thing is that in syslog the entries from this container have
docker instead of usual container hash.
docker-ce version is
5:18.09.0~3-0~debian-stretch but it had the same
behavior before this version too.