This topic describes how to deploy a Logtail container and create a Logtail configuration file to collect logs from standard Docker containers.
Step 1: Deploy a Logtail container
Step 2: Create a Logtail configuration file
Create a Logtail configuration file in the console based on your business requirements.
- To collect Docker text logs, follow the steps that you perform to collect Kubernetes text logs. For more information, see Use the console to collect Kubernetes text logs in DaemonSet mode.
- To collect Docker stdout and stderr logs, follow the steps that you perform to collect Kubernetes stdout and stderr logs. For more information, see Use the console to collect Kubernetes stdout and stderr logs in DaemonSet mode.
- To collect host text logs, follow the steps provided in Collect text logs.
By default, the root directory of the host is mounted on the
/logtail_host
directory of the Logtail container. When you configure the directory to collect logs, you must add the container directory as the prefix to the log path. For example, to collect logs from the/home/logs/app_log/
directory of the host, you must set the log path to/logtail_host/home/logs/app_log/
.
ALIYUN_LOGTAIL_USER_DEFINED_ID
parameter in the Custom Identifier field. This value is specified in Step 1: Deploy a Logtail container. 
Default fields
- Docker stdout and stderr logs
The following table describes the fields that are uploaded by default for each log entry.
Log field Description _time_
The time when the data is uploaded, for example, 2018-02-02T02:18:41.979147844Z
._source_
The type of a data source. Valid values: stdout and stderr. _image_name_
The name of an image. _container_name_
The name of a container. _container_ip_
The IP address assigned to the pod where a container resides. - Docker text logs
The following table describes the fields that are uploaded by default for each log entry.
Log field Description _image_name_
The name of an image. _container_name_
The name of a container. _container_ip_
The IP address assigned to the pod where a container resides.
Related operations
- View the status of Logtail.
You can run the
docker exec ${logtail_container_id} /etc/init.d/ilogtaild status
command to view the status of Logtail. - View the version number, IP address, and startup time of Logtail.
You can run the
docker exec ${logtail_container_id} cat /usr/local/ilogtail/app_info.json
command to view the information of Logtail. - View the operational logs of Logtail.
The operational logs of Logtail are stored in the
ilogtail.LOG
file in the/usr/local/ilogtail/
directory. If the log file is rotated and compressed, it is stored as a file namedilogtail.LOG.x.gz
.Example:[root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 tail -n 5 /usr/local/ilogtail/ilogtail.LOG [2018-02-06 08:13:35.721864] [INFO] [8] [build/release64/sls/ilogtail/LogtailPlugin.cpp:104] logtail plugin Resume:start [2018-02-06 08:13:35.722135] [INFO] [8] [build/release64/sls/ilogtail/LogtailPlugin.cpp:106] logtail plugin Resume:success [2018-02-06 08:13:35.722149] [INFO] [8] [build/release64/sls/ilogtail/EventDispatcher.cpp:369] start add existed check point events, size:0 [2018-02-06 08:13:35.722155] [INFO] [8] [build/release64/sls/ilogtail/EventDispatcher.cpp:511] add existed check point events, size:0 cache size:0 event size:0 success count:0 [2018-02-06 08:13:39.725417] [INFO] [8] [build/release64/sls/ilogtail/ConfigManager.cpp:3776] check container path update flag:0 size:1
The standard output of the container is irrelevant to this case. Ignore the following standard output:start umount useless mount points, /shm$|/merged$|/mqueue$ umount: /logtail_host/var/lib/docker/overlay2/3fd0043af174cb0273c3c7869500fbe2bdb95d13b1e110172ef57fe840c82155/merged: must be superuser to unmount umount: /logtail_host/var/lib/docker/overlay2/d5b10aa19399992755de1f85d25009528daa749c1bf8c16edff44beab6e69718/merged: must be superuser to unmount umount: /logtail_host/var/lib/docker/overlay2/5c3125daddacedec29df72ad0c52fac800cd56c6e880dc4e8a640b1e16c22dbe/merged: must be superuser to unmount ...... xargs: umount: exited with status 255; aborting umount done start logtail ilogtail is running logtail status: ilogtail is running
- Restart Logtail.
To restart Logtail, use the following sample code:
[root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild stop kill process Name: ilogtail pid: 7 kill process Name: ilogtail pid: 8 stop success [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild start ilogtail is running