How to use docker desktop logs command to view Docker Desktop logs

Introduction

In this lab, you will learn how to effectively use the docker desktop logs command to view and analyze logs generated by your Docker containers. Understanding container logs is crucial for debugging applications and monitoring their behavior.

This hands-on lab will guide you through viewing basic container logs, and then demonstrate how to filter these logs based on priority, time range, and the specific unit (container or service) generating the logs. By the end of this lab, you will be proficient in using the docker desktop logs command to gain valuable insights into your containerized applications.

Skills Graph

View basic Docker Desktop logs

In this step, you will learn how to view basic logs from Docker containers. Logs are essential for debugging and monitoring your applications running in containers.

First, let's run a simple container that generates some output. We will use the hello-world image, which is a very small image that prints a message and exits.

docker run hello-world

You should see output similar to this, indicating that the Docker daemon pulled the image and ran the container successfully:

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:f52335ce493178fc15f729218f180e9988e31c374a6ce98da40cbb890f97f10e
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (Assuming it was not already locally available.)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To learn more, try the following commands:
 docker run -it ubuntu bash
 docker images
 docker ps
 docker stop <containerid>
 docker rm <containerid>
To get started with Docker Desktop, visit:
 https://www.docker.com/products/docker-desktop

The output you see is the standard output (stdout) and standard error (stderr) streams from the container. Docker captures these streams and makes them available as logs.

Now, let's run a container that stays running and generates logs over time. We will use the alpine image and run a simple command that prints a message every 5 seconds.

First, pull the alpine image:

docker pull alpine

You should see output indicating the image is being pulled:

Using default tag: latest
latest: Pulling from library/alpine
... (output showing download progress)
Digest: sha256:...
Status: Downloaded newer image for alpine:latest
docker.io/library/alpine:latest

Now, run the alpine container in detached mode (-d) so it runs in the background, and give it a name (--name mylogger) for easy reference. The command while true; do echo "Hello from mylogger at $(date)"; sleep 5; done will print a message with the current date every 5 seconds.

docker run -d --name mylogger alpine sh -c 'while true; do echo "Hello from mylogger at $(date)"; sleep 5; done'

This command will output the container ID.

To view the logs of the running container, use the docker logs command followed by the container name or ID.

docker logs mylogger

You will see the output generated by the container's command, with a new line appearing approximately every 5 seconds. You can press Ctrl+C to stop viewing the logs.

To follow the logs in real-time, use the -f (follow) option:

docker logs -f mylogger

This will continuously display new log entries as they are generated. Press Ctrl+C to stop following the logs.

Finally, let's stop and remove the container we created:

docker stop mylogger
docker rm mylogger

This cleans up the container resources.

Filter logs by priority

In this step, you will learn how to filter Docker container logs based on their priority level. While standard docker logs doesn't have built-in priority filtering like systemd-journald, you can achieve similar filtering by using tools like grep to search for specific keywords or patterns in the log output.

Let's use the alpine container we used in the previous step. If you stopped and removed it, run it again:

docker run -d --name mylogger alpine sh -c 'while true; do echo "INFO: Hello from mylogger at $(date)"; sleep 5; echo "WARNING: Something is happening at $(date)"; sleep 5; echo "ERROR: An error occurred at $(date)"; sleep 5; done'

This command runs the container in detached mode and prints messages with different "priority" prefixes (INFO, WARNING, ERROR) every 5 seconds.

Now, let's view the logs and filter them to only show lines that contain "ERROR". We can pipe the output of docker logs to grep.

docker logs mylogger | grep "ERROR"

You will see only the lines from the container logs that contain the word "ERROR".

Similarly, to view only lines containing "WARNING":

docker logs mylogger | grep "WARNING"

And to view lines containing "INFO":

docker logs mylogger | grep "INFO"

You can also combine filters. For example, to see lines containing either "WARNING" or "ERROR", you can use the -E option with grep for extended regular expressions and the | operator:

docker logs mylogger | grep -E "WARNING|ERROR"

This will show you all log entries that are either warnings or errors.

Remember that this method relies on the container's application writing logs with specific keywords. For more structured logging and advanced filtering, consider using a dedicated logging driver or a logging solution outside of Docker.

Finally, stop and remove the container:

docker stop mylogger
docker rm mylogger

Filter logs by time range

In this step, you will learn how to filter Docker container logs based on a specific time range. This is useful for examining logs from a particular period, for example, during an incident or a specific deployment.

The docker logs command provides options to filter logs by time. We will use the alpine container again. If it's not running, start it with the same command as before:

docker run -d --name mylogger alpine sh -c 'while true; do echo "INFO: Hello from mylogger at $(date)"; sleep 5; echo "WARNING: Something is happening at $(date)"; sleep 5; echo "ERROR: An error occurred at $(date)"; sleep 5; done'

Let the container run for a minute or two to generate some logs.

To view logs generated since a specific time, use the --since option. The time can be specified in various formats, including a timestamp (seconds since epoch), a relative time (e.g., 10m for 10 minutes, 1h for 1 hour), or a date/time string.

Let's view logs generated in the last 2 minutes:

docker logs --since 2m mylogger

This command will display all log entries from the mylogger container that were generated within the last 2 minutes.

You can also specify a start and end time using --since and --until. The --until option works similarly to --since, allowing you to specify a time up to which you want to see logs.

To view logs generated between 5 minutes ago and 1 minute ago:

docker logs --since 5m --until 1m mylogger

This command will show logs from the specified time window. Note that the exact output will depend on when you run the command and how long the container has been running.

You can also use specific timestamps. To get the current timestamp, you can use the date +%s command.

Let's get the timestamp for 1 minute ago:

date -d "1 minute ago" +%s

Now, use this timestamp with --until to see logs up to 1 minute ago:

docker logs --until $(date -d "1 minute ago" +%s) mylogger

This command will display logs from the start of the container's life up to 1 minute ago.

Filtering by time range is a powerful way to narrow down your log analysis and focus on relevant events.

Finally, stop and remove the container:

docker stop mylogger
docker rm mylogger

Filter logs by unit

In this step, you will learn how to filter Docker container logs by the "unit" that generated them. In the context of Docker logs, the "unit" typically refers to the container itself. While docker logs inherently operates on a single container (or unit), understanding this concept is important when working with more advanced logging systems or when you need to distinguish logs from different containers.

The primary way to filter logs by unit in Docker is by specifying the container name or ID when using the docker logs command. We have been doing this in the previous steps.

Let's run two different containers to see how their logs are separated. We will use the alpine image for both, but with different names and slightly different commands.

First, ensure the mylogger container from previous steps is stopped and removed.

docker stop mylogger || true
docker rm mylogger || true

Now, run the first container, named container1:

docker run -d --name container1 alpine sh -c 'while true; do echo "Container 1 log at $(date)"; sleep 3; done'

This container will print a log message every 3 seconds.

Next, run a second container, named container2:

docker run -d --name container2 alpine sh -c 'while true; do echo "Container 2 log at $(date)"; sleep 5; done'

This container will print a log message every 5 seconds.

Now, to view the logs specifically from container1, use:

docker logs container1

You will only see the log messages generated by container1.

To view the logs specifically from container2, use:

docker logs container2

You will only see the log messages generated by container2.

This demonstrates how docker logs inherently filters by the specified container (the "unit"). If you were using a centralized logging system that collects logs from multiple containers, you would typically use metadata associated with each log entry (like container name or ID) to filter by unit.

While docker logs itself doesn't have a separate --unit flag like some system logging tools, the fundamental concept of filtering by the source of the log (the container) is achieved by specifying the container name or ID.

Finally, stop and remove both containers:

docker stop container1 container2
docker rm container1 container2

Summary

In this lab, you learned the fundamental skill of viewing Docker container logs using the docker logs command. You began by running simple containers like hello-world and alpine to understand how Docker captures standard output and error streams as logs. This initial step demonstrated the basic process of accessing container output, which is crucial for monitoring and debugging applications running within containers.

Building upon the basic log viewing, you explored advanced filtering options to efficiently manage and analyze log data. You learned how to filter logs by priority levels, allowing you to focus on critical messages. Furthermore, you practiced filtering logs by specific time ranges to isolate events within a particular timeframe and by unit to view logs from specific services or components. These filtering techniques are essential for navigating large volumes of log data and quickly identifying relevant information for troubleshooting and analysis.