19.2.4 Logs CLI Command

docker logs retrieves the output that a container's process has written to stdout and stderr. Docker captures this output automatically for every container and stores it in log files managed by the configured logging driver. The docker logs command reads from those captured logs and displays them in the terminal, making it the primary tool for inspecting what a container has done, diagnosing startup failures, and monitoring container behavior in real time.

Basic Syntax

docker logs [OPTIONS] CONTAINER

The container can be referenced by name or ID (running or stopped).

Viewing All Logs

docker logs my-container

Outputs everything the container has written to stdout and stderr since it started. By default, stdout appears as regular output and stderr appears mixed in (Docker does not separate them in the terminal output by default).

Following Logs in Real Time

The -f (or --follow) flag keeps the log stream open, printing new output as it is written — equivalent to tail -f:

docker logs -f my-container

Press Ctrl+C to stop following. The container continues running; only the log stream to the terminal is closed.

Showing Only the Last N Lines

The --tail flag limits output to the most recent N lines:

docker logs --tail 100 my-container

docker logs --tail 50 my-container

--tail 0 prints no historical lines and, combined with -f, streams only new output from now forward:

docker logs --tail 0 -f my-container

Including Timestamps

The -t (or --timestamps) flag prepends each log line with a timestamp in RFC3339Nano format:

docker logs -t my-container

2024-06-15T10:32:45.123456789Z Starting server on port 8080
2024-06-15T10:32:45.456789012Z Database connected
2024-06-15T10:33:01.001234567Z Received request GET /health

Timestamps reflect when Docker captured the line, which is when the container wrote it to stdout or stderr.

Filtering by Time

The --since and --until flags restrict output to logs within a time range.

Show logs from the last hour:

docker logs --since 1h my-container

Show logs since a specific timestamp:

docker logs --since "2024-06-15T10:00:00" my-container

Show logs before a specific time:

docker logs --until "2024-06-15T11:00:00" my-container

Combine both to narrow to a specific window:

docker logs --since "2024-06-15T10:30:00" --until "2024-06-15T10:45:00" my-container

The --since flag also accepts duration strings: 1h, 30m, 5m, 1h30m.

Separating stdout and stderr

Docker does not separate stdout and stderr in terminal output by default. Both streams appear interleaved. Redirect to files to separate them:

docker logs my-container > stdout.log 2> stderr.log

Or to inspect only stderr:

docker logs my-container 2>&1 >/dev/null

Logs for Stopped Containers

docker logs works on stopped containers. The logs persist in Docker's storage until the container is removed:

docker ps -a
# Find a stopped container

docker logs stopped-container

This is essential for post-mortem analysis of containers that failed during startup or crashed unexpectedly.

# View logs of the most recently created container
docker logs $(docker ps -a -q -l)

Combining Options

# Last 200 lines with timestamps, following new output
docker logs -f --tail 200 -t my-container

# Logs from the last 30 minutes
docker logs --since 30m my-container

Available Options Summary

Logging Drivers and Limitations

docker logs only works when the container uses a logging driver that stores logs locally. The default driver (json-file) and the local driver support docker logs. Other drivers (such as syslog, fluentd, awslogs, gelf, splunk) forward logs to external systems and do not support docker logs:

docker logs my-container

Error response from daemon: configured logging driver does not support reading

When external logging drivers are in use, logs must be retrieved from the external system (e.g., CloudWatch, Splunk, Elasticsearch).

The current logging driver for a container can be inspected:

docker inspect --format '{{.HostConfig.LogConfig.Type}}' my-container

Log Rotation

By default, Docker's json-file driver does not rotate logs, which means log files grow indefinitely. To configure rotation:

docker run -d \
  --log-opt max-size=10m \
  --log-opt max-file=5 \
  my-container

Or globally in /etc/docker/daemon.json:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  }
}

With this setting, Docker keeps at most 5 log files per container, each up to 10 MB, rotating the oldest when the limit is reached.