How to use docker compose logs command to view container output

Introduction

In this lab, you will learn how to effectively use the docker logs command to view the output of your Docker containers. We will start by understanding how to view basic logs from a running container.

Building upon the basics, you will then explore how to follow container logs in real-time, which is crucial for monitoring and debugging active processes. Finally, you will learn how to enhance your log viewing experience by including timestamps, specifying the number of lines to display from the end of the logs, and filtering logs based on a time range.

Skills Graph

Start services and view basic logs

In this step, we will learn how to start a Docker container and view its basic logs. Logs are essential for understanding what is happening inside a container, debugging issues, and monitoring its behavior.

First, let's pull a simple Nginx image from Docker Hub. This image will be used to run a web server container.

docker pull nginx:latest

You should see output indicating that the image is being downloaded. Once the download is complete, you can verify that the image is available locally by listing the images:

docker images

Now, let's run a container based on the Nginx image. We will run it in detached mode (-d) so it runs in the background, and we will name it my-nginx.

docker run -d --name my-nginx nginx

The output of this command will be the container ID. This means the container has started successfully in the background.

To see the basic logs generated by the my-nginx container, we use the docker logs command followed by the container name or ID.

docker logs my-nginx

You will see the standard output and standard error streams from the Nginx process running inside the container. These logs typically include information about the Nginx server starting up and handling requests.

Follow logs in real-time

In the previous step, we viewed the logs of a container after it had started. However, sometimes you need to see logs as they are being generated, in real-time. This is particularly useful for debugging or monitoring active processes.

To follow the logs of a container in real-time, we use the docker logs command with the -f (or --follow) option. This will keep the terminal open and display new log entries as they appear.

Let's follow the logs of our my-nginx container:

docker logs -f my-nginx

The command will start displaying the current logs and then wait for new log entries. Since our Nginx container is running but not actively serving requests, you might not see new logs immediately.

To generate some new log entries, we can send a request to the Nginx web server running inside the container. By default, Nginx listens on port 80. Although we didn't map the port to the host in the docker run command, we can still access the container's network internally from the host using curl.

Open a new terminal tab in the LabEx environment. In this new tab, execute the following command to send a request to the Nginx container:

curl http://localhost:80

You should see the default Nginx welcome page HTML output in the new terminal tab.

Now, switch back to the terminal tab where you are following the logs (docker logs -f my-nginx). You should see new log entries appear, indicating that Nginx processed the request from curl. These entries typically include information about the client IP, the request method, the requested path, and the HTTP status code.

To stop following the logs, press Ctrl+C in the terminal where docker logs -f is running.

View logs with timestamps and specific tail

In the previous steps, we viewed basic logs and followed logs in real-time. However, the basic docker logs output doesn't include timestamps, which can make it difficult to correlate events or understand the timing of log entries. Also, sometimes you only need to see the most recent log entries.

To include timestamps in the log output, we use the -t (or --timestamps) option with the docker logs command.

Let's view the logs of our my-nginx container with timestamps:

docker logs -t my-nginx

You will now see a timestamp prepended to each log entry, indicating when that log entry was generated by the container. This is very helpful for debugging and analysis.

Sometimes, you are only interested in the most recent log entries, similar to using the tail command in Linux. The docker logs command provides the --tail option for this purpose. You can specify the number of lines you want to see from the end of the logs.

For example, to view only the last 5 log entries of the my-nginx container:

docker logs --tail 5 my-nginx

This will output only the final 5 lines of the container's logs. You can combine --tail with -t to see the last few entries with timestamps.

docker logs -t --tail 5 my-nginx

This command will show the last 5 log entries, each with its corresponding timestamp.

Filter logs by time range

In addition to viewing all logs or the most recent ones, you can also filter container logs by a specific time range. This is useful when you are investigating events that occurred during a particular period.

The docker logs command provides the --since and --until options to filter logs based on time. These options accept various time formats, including RFC3339 timestamps, Unix timestamps, or relative times (e.g., 10m for 10 minutes, 1h for 1 hour).

Let's try filtering logs. First, we need to generate some logs at different times. We can do this by sending curl requests to the Nginx container again.

Open a new terminal tab and run the curl command a few times with a short delay between them.

curl http://localhost:80
sleep 5
curl http://localhost:80
sleep 5
curl http://localhost:80

Now, let's view the logs from the my-nginx container with timestamps to see the times of these requests.

docker logs -t my-nginx

Observe the timestamps of the log entries generated by the curl commands.

To filter logs since a specific time, you can use the --since option. For example, to view logs generated in the last 1 minute:

docker logs --since 1m my-nginx

This command will show all log entries from the my-nginx container that were generated within the last minute.

You can also filter logs up to a specific time using the --until option. For example, to view logs generated before 1 minute ago:

docker logs --until 1m my-nginx

This command will show all log entries from the my-nginx container that were generated more than one minute ago.

You can combine --since and --until to view logs within a specific time window. For example, to view logs between 5 minutes ago and 1 minute ago:

docker logs --since 5m --until 1m my-nginx

Remember that the exact output will depend on when you executed the curl commands and when you run the docker logs commands.

Summary

In this lab, we learned the fundamental steps of using the docker logs command to view container output. We began by pulling a Docker image and running a container in detached mode. Subsequently, we explored how to view the basic logs generated by the running container, which provides insight into its startup and activity.

Furthermore, we advanced our understanding by learning how to follow container logs in real-time using the -f option, enabling continuous monitoring of log streams as they are generated. This real-time logging is crucial for debugging and observing the dynamic behavior of containers.