How to use docker container logs command to view container output

Introduction

In this lab, you will learn how to effectively use the docker container logs command to view the output generated by your Docker containers. We will start by running a simple container that produces logs, then explore the basic usage of docker logs to retrieve this output.

You will then learn how to enhance the log output by including timestamps and detailed information. Finally, we will cover how to filter logs based on time, allowing you to view logs since a specific point or tail the output, and how to view logs up to a particular time. This lab provides hands-on experience with essential Docker logging techniques for monitoring and debugging your containerized applications.

Skills Graph

Run a container that generates logs

In this step, we will learn how to run a Docker container that generates logs. Logs are essential for debugging and monitoring applications running inside containers. We will use a simple hello-world image for this purpose, as it outputs a message and then exits, which is a good starting point to see basic container logging.

First, let's pull the hello-world image from Docker Hub. This ensures that the image is available locally before we try to run a container from it.

docker pull hello-world

You should see output indicating that the image is being pulled and downloaded.

Using default tag: latest
latest: Pulling from library/hello-world
...
Status: Downloaded newer image for hello-world:latest
docker.io/library/hello-world:latest

Now, let's run a container using the hello-world image. The docker run command creates and starts a new container. By default, Docker captures the standard output (stdout) and standard error (stderr) of the container's process and stores it as logs.

docker run hello-world

When you run this command, the hello-world container will execute, print a message to your terminal, and then exit. This message is the output that Docker captures as logs.

Hello from Docker!
This message shows that your installation appears to be working correctly.
...

Although the output is displayed directly in your terminal when running a simple container like hello-world, for containers running in the background or more complex applications, you will need to use the docker logs command to view their output. We will explore the docker logs command in the next steps.

View basic container logs

In the previous step, we ran a hello-world container which printed a message to the console and exited. While this was useful for a quick demonstration, real-world applications often run continuously in the background. To view the output (logs) of such containers, we use the docker logs command.

First, let's run a container that stays running and generates some output. We will use a simple ubuntu image and run a command that prints a message every few seconds. We will run this container in detached mode (-d) so it runs in the background. We also give it a name (my-logging-container) for easy identification.

docker pull ubuntu
docker run -d --name my-logging-container ubuntu /bin/bash -c 'while true; do echo "Hello from the container at $(date)"; sleep 5; done'

The docker pull ubuntu command downloads the Ubuntu image. The docker run command starts a new container named my-logging-container in detached mode. The command executed inside the container is /bin/bash -c 'while true; do echo "Hello from the container at $(date)"; sleep 5; done', which is a simple shell script that prints a message with the current date and time every 5 seconds.

You will see a container ID printed to your console, indicating that the container has started in the background.

Unable to find image 'ubuntu:latest' locally
latest: Pulling from library/ubuntu
...
Status: Downloaded newer image for ubuntu:latest
sha256:...

Now that our container is running and generating logs, we can view these logs using the docker logs command followed by the container name or ID.

docker logs my-logging-container

This command will display all the logs generated by the my-logging-container since it started. You should see a series of "Hello from the container..." messages with timestamps.

Hello from the container at ...
Hello from the container at ...
Hello from the container at ...
...

The docker logs command is a fundamental tool for inspecting the output of your containers, which is crucial for understanding their behavior and diagnosing issues.

View logs with timestamps and details

In the previous step, we viewed the basic logs of a running container. While the output itself is useful, it often lacks context, such as when each log entry was generated. Docker provides options to include timestamps and other details with the logs.

To view logs with timestamps, we can use the -t or --timestamps flag with the docker logs command. This will prepend a timestamp to each log entry, showing when it was written to the container's standard output or standard error.

Let's view the logs of our my-logging-container with timestamps:

docker logs -t my-logging-container

You will now see the logs with a timestamp at the beginning of each line. The timestamps are in RFC3339Nano format (e.g., 2023-10-27T10:30:00.123456789Z).

2023-10-27T10:30:00.123456789Z Hello from the container at ...
2023-10-27T10:30:05.123456789Z Hello from the container at ...
2023-10-27T10:30:10.123456789Z Hello from the container at ...
...

Including timestamps is crucial for analyzing logs, especially when trying to understand the sequence of events or pinpoint when a specific issue occurred.

Another useful option is the -f or --follow flag, which allows you to stream the logs in real-time. This is similar to using the tail -f command on a log file. Let's try this with our container:

docker logs -f my-logging-container

This command will display the existing logs and then continue to show new log entries as they are generated by the container. You will see new "Hello from the container..." messages appearing every 5 seconds.

To stop following the logs, press Ctrl+C.

Combining the -t and -f flags is a common practice for monitoring container logs in real-time with timestamps:

docker logs -tf my-logging-container

This provides a live view of the container's output, making it easier to observe its behavior and debug issues as they happen.

View logs since a specific time or tail the output

In this step, we will explore how to view container logs generated after a specific time or view only the most recent log entries. This is particularly useful when dealing with containers that have been running for a long time and have generated a large volume of logs.

To view logs generated since a specific time, you can use the --since flag. The value for --since can be a timestamp (like the ones we saw with the -t flag) or a relative time duration (e.g., 10m for 10 minutes, 1h for 1 hour).

Let's wait for a few seconds to allow our my-logging-container to generate some more logs. Then, we will view the logs generated in the last 30 seconds.

sleep 30
docker logs --since 30s my-logging-container

This command will display only the log entries that were generated within the last 30 seconds. The output will be similar to the full logs, but it will only include the recent entries.

Hello from the container at ...
Hello from the container at ...
Hello from the container at ...
... (only logs from the last 30 seconds)

Another common requirement is to view only the last few lines of the logs, similar to using the tail command. You can achieve this using the --tail flag, followed by the number of lines you want to see.

Let's view the last 5 lines of the logs from our container:

docker logs --tail 5 my-logging-container

This command will output only the most recent 5 log entries from the container.

Hello from the container at ...
Hello from the container at ...
Hello from the container at ...
Hello from the container at ...
Hello from the container at ... (the last 5 lines)

You can combine --since and --tail with other flags like -t and -f to get more specific views of your container logs. For example, to view the last 10 lines with timestamps:

docker logs -t --tail 10 my-logging-container

These options provide powerful ways to filter and view container logs, making it easier to find the information you need quickly.

View logs until a specific time

In addition to viewing logs since a specific time, you can also view logs generated until a specific time using the --until flag. This is useful for examining logs up to a certain point in time, for example, before an issue occurred.

The value for --until can also be a timestamp or a relative time duration.

Let's wait for a few seconds again to ensure more logs are generated.

sleep 10

Now, let's view the logs from our my-logging-container that were generated until 10 seconds ago.

docker logs --until 10s my-logging-container

This command will display all log entries from the beginning of the container's life up to approximately 10 seconds before you ran the command. You will see the initial log entries, but the most recent ones will be excluded.

Hello from the container at ...
Hello from the container at ...
... (logs up to 10 seconds ago)

You can combine --since and --until to view logs within a specific time range. For example, to view logs generated between 2 minutes ago and 30 seconds ago:

docker logs --since 2m --until 30s my-logging-container

This command will show only the log entries that fall within that specific time window.

Finally, to clean up the running container, you can stop and remove it.

docker stop my-logging-container
docker rm my-logging-container

The docker stop command sends a stop signal to the container, and docker rm removes the container.

Understanding how to filter logs by time is a powerful skill for debugging and analyzing the behavior of your Docker containers.

Summary

In this lab, we learned how to view container logs using the docker logs command. We started by running a simple hello-world container to understand how Docker captures standard output as logs.

We then explored the basic usage of docker logs to retrieve the output of a container. We also learned how to enhance the log output by including timestamps and detailed information, and how to filter logs based on time, viewing logs since a specific time or until a specific time, and how to tail the output to see the latest log entries.