A Docker container log router that attaches to all containers on a host and routes their logs to various destinations.
Logspout is a log router for Docker containers that runs inside Docker itself. It attaches to all containers on a host, collects their stdout and stderr logs, and routes them to external destinations like syslog servers, HTTP endpoints, or custom backends. It solves the problem of centralized log collection in Dockerized environments without requiring per-container log driver configuration.
DevOps engineers, SREs, and developers running Dockerized applications who need a simple, unified way to stream container logs to external logging systems (e.g., Papertrail, Loggly, ELK stack) without modifying each container.
Developers choose Logspout for its simplicity, small footprint (15.2MB Alpine-based image), and extensibility. It requires minimal configuration, supports real-time log streaming and filtering, and integrates seamlessly with Docker's API, making it a lightweight alternative to heavier log shippers.
Log routing for Docker container logs
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Logspout attaches to all running Docker containers automatically via the mounted Unix socket, eliminating per-container log driver configuration as shown in the basic usage examples.
Supports custom adapters and transports for various backends like syslog, TLS, and HTTP, with third-party modules available for Kafka, Logstash, and Graylog, enabling flexible log routing.
Includes an HTTP stream module that provides a live, color-coded view of aggregated logs via curl or WebSocket, useful for local inspection without setting up external routes.
Allows filtering logs by container name, ID, labels, or sources using URI parameters or environment variables, enabling targeted log routing to multiple destinations simultaneously.
Only captures stdout and stderr; the README admits a module for container syslog is planned but not yet available, restricting log collection from other sources.
Routes created via the REST API are ephemeral by default; persisting them requires mounting a volume to /mnt/routes, adding operational complexity for state management.
Using BACKLOG=false to suppress tail backlog may cause missed log lines if containers output before logspout attaches, as warned in the documentation, compromising log completeness.