Clarify documentation about using rotating logs?

[pavlovdog]

The documentation actually is amazing, but for me (maybe for someone else) it's not clear: can I use the rotating logs setup with the logspout?

For example, I have the following command for starting some docker container:

docker run --log-opt max-size=10m --log-opt max-file=5 ...

And the Logstash command is:

docker run -d --name=logspout\
 --volume=/var/run/docker.sock:/var/run/docker.sock\
 gliderlabs/logspout\
 tcp://address:ip

As I know, the docker rotating logs mechanism will remove the "old-logs", so the total size of all logfiles will remain constant. Is this not a problem for Logspout? Can logspout correctly process multiple log files?

[30mb1]

+1, good question

[erbrecht]

FWIW I tested this out and it was working just fine for me. This is based on my admittedly minimal testing. I believe logspout uses the the docker api to get logs instead of looking directly at files in the filesystem. You can have a container running, and go through log rotations before logspout starts up, and it should pick up the backlog of log entries.

The only time I ran into a problem was if I restarted an existing container. I got duplicate log entries, but I think that has nothing to do with log rotation. Setting BACKLOG=false prevents the duplicate entries, but that will also cause logspout to miss log entries that were created prior to logspout startup. That's the normal behavior even without docker log rotation.