logspout

what is it?

a log router for Docker containers that runs inside Docker. It attaches to all containers on a host, then routes their logs wherever you want. It also has an extensible module system. github link

implementation

docker-compose

docker-compose.yml

services:
  logspout:
    image: gliderlabs/logspout
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - ROUTE_URIS=logstash+tcp://logstash:5044  # Example: Route logs to Logstash

an issue with this method is that logspout will literally forward all container logs onward.. not just the ones configured in the above docker-compose.yml file, as logspout is designed to capture logs from all containers running on the same docker daemon by default. It uses the docker API to access logs from containers via the mounted docker socket (/var/run/docker.sock).