How do you view container logs in Docker?

Question

Accepted Answer

Docker captures everything written to stdout and stderr as container logs Logs from files inside the container are NOT captured by docker logs The default logging driver is json-file — stores logs as JSON on the host docker logs works for both running and stopped containers Logs persist until the container is removed or logs are rotated Container name or container ID can be used interchangeably # View all logs of a container
docker logs my-container

# View logs by container ID
docker logs a1b2c3d4e5f6

# View logs by partial ID
docker logs a1b2 # -f or --follow — stream logs in real time (like tail -f)
docker logs -f my-container

# ✅ Most common command for debugging live issues
# Press Ctrl+C to stop following

# Follow logs for a specific service in docker-compose
docker compose logs -f my-service # Show last 50 lines only
docker logs --tail 50 my-container

# Show last 100 lines and follow live
docker logs --tail 100 -f my-container

# Show only the last line
docker logs --tail 1 my-container

# Show ALL logs from beginning (default behavior)
docker logs --tail all my-container # -t or --timestamps — prefix each log line with timestamp
docker logs -t my-container

# Output example:
# 2024-03-15T10:23:45.123456789Z Server started on port 3000
# 2024-03-15T10:23:46.234567890Z Connected to database
# 2024-03-15T10:23:47.345678901Z GET /api/users 200 45ms

# Combine timestamps with follow
docker logs -tf my-container

# Timestamps + last 50 lines + follow
docker logs -tf --tail 50 my-container # --since — show logs after a specific time
# Supports duration strings and timestamps

# Logs from last 10 minutes
docker logs --since 10m my-container

# Logs from last 2 hours
docker logs --since 2h my-container

# Logs since a specific timestamp (RFC 3339)
docker logs --since 2024-03-15T10:00:00 my-container

# Logs since a Unix timestamp
docker logs --since 1710496800 my-container

# --until — show logs BEFORE a specific time
docker logs --until 2024-03-15T11:00:00 my-container

# Combine since and until — logs in a specific time window
docker logs \
  --since 2024-03-15T10:00:00 \
  --until 2024-03-15T11:00:00 \
  my-container

# Last 30 minutes and follow
docker logs --since 30m -f my-container # Docker logs has no built-in grep — pipe to grep

# Find all ERROR lines
docker logs my-container | grep ERROR

# Case-insensitive search
docker logs my-container | grep -i error

# Show 3 lines before and after each match (context)
docker logs my-container | grep -C 3 'connection refused'

# ✅ Pipe stderr and stdout both to grep
# By default docker logs outputs to stdout AND stderr
docker logs my-container 2>&1 | grep ERROR

# Search live logs in real time
docker logs -f my-container | grep --line-buffered ERROR

# Count occurrences of a pattern
docker logs my-container | grep -c 'ERROR'

# Filter out noise — exclude health check logs
docker logs my-container | grep -v 'health' # Save all logs to a file
docker logs my-container > app.log

# Save stdout AND stderr to the same file
docker logs my-container > app.log 2>&1

# Save stderr separately
docker logs my-container > stdout.log 2> stderr.log

# Append to existing log file
docker logs my-container >> app.log

# Save last 1000 lines with timestamps
docker logs -t --tail 1000 my-container > debug.log

# Stream live logs to a file
docker logs -f my-container >> live.log & # View logs for ALL services
docker compose logs

# Follow all services live
docker compose logs -f

# View logs for a specific service only
docker compose logs my-service

# Follow a specific service
docker compose logs -f my-service

# Multiple services
docker compose logs -f service1 service2

# Last 50 lines per service
docker compose logs --tail 50

# With timestamps
docker compose logs -t -f my-service

# Since last 5 minutes
docker compose logs --since 5m my-service # Check current logging driver of a container
docker inspect my-container | grep -A 10 '"LogConfig"'

# Configure logging driver when running a container

# json-file (default) — logs stored as JSON on host
docker run --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  nginx

# none — disable all logging (docker logs won't work)
docker run --log-driver none nginx

# syslog — send logs to syslog
docker run --log-driver syslog nginx

# journald — send logs to systemd journal
docker run --log-driver journald nginx

# fluentd — send to Fluentd aggregator
docker run --log-driver fluentd \
  --log-opt fluentd-address=localhost:24224 \
  nginx

# awslogs — send to AWS CloudWatch
docker run --log-driver awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=my-app \
  nginx

# ⚠️ docker logs ONLY works with json-file and journald drivers
# Other drivers send logs externally — docker logs returns nothing # Configure log rotation per container
docker run \
  --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=5 \
  --name my-app \
  my-image
# max-size=10m  — rotate when log

How do you view container logs in Docker?

How do you view container logs in Docker?

Scenario Questions

Follow-up Questions