Collect Logs from Docker Containers

Docker containers write logs to stdout/stderr. You have two options to ship those logs to LogFlow: send them directly from your app using the SDK, or use a log forwarder like Fluent Bit that reads container output and forwards it without changing application code.

Option A — SDK inside the container (recommended for new apps)

If you control the application code, install the LogFlow SDK directly. This gives you structured logs with custom metadata.

Add to your Dockerfile:

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .

ENV LOGFLOW_API_KEY=""
ENV NODE_ENV="production"

CMD ["node", "src/index.js"]

In your app code:

import { LogFlow } from '@getlogflow/js'

const logger = new LogFlow({
  apiKey: process.env.LOGFLOW_API_KEY,
  service: process.env.SERVICE_NAME || 'app',
  host: process.env.HOSTNAME,   // Docker sets this automatically
})

Pass the API key via docker run:

docker run -e LOGFLOW_API_KEY=lf_your_key -e SERVICE_NAME=api your-image

Or in docker-compose.yml:

version: '3.8'
services:
  api:
    image: your-api-image
    environment:
      LOGFLOW_API_KEY: ${LOGFLOW_API_KEY}
      SERVICE_NAME: api

Option B — Fluent Bit sidecar (no code changes)

Fluent Bit reads container logs from the Docker socket and forwards them to LogFlow's HTTP API. Use this when you can't modify the application code.

Step 1 — Create Fluent Bit config

Create fluent-bit/fluent-bit.conf:

[SERVICE]
    Flush        5
    Log_Level    warn

[INPUT]
    Name         forward
    Listen       0.0.0.0
    Port         24224

[OUTPUT]
    Name         http
    Match        *
    Host         api.getlogflow.com
    Port         443
    URI          /v1/logs
    Format       json
    Header       Authorization Bearer lf_your_api_key
    Header       Content-Type application/json
    tls          On
    tls.verify   On

Create fluent-bit/parsers.conf:

[PARSER]
    Name        docker
    Format      json
    Time_Key    time
    Time_Format %Y-%m-%dT%H:%M:%S.%L

Step 2 — Add to docker-compose

version: '3.8'
services:
  api:
    image: your-api-image
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
        tag: api

  worker:
    image: your-worker-image
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
        tag: worker

  fluent-bit:
    image: fluent/fluent-bit:3
    volumes:
      - ./fluent-bit/fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf
      - ./fluent-bit/parsers.conf:/fluent-bit/etc/parsers.conf
    ports:
      - "24224:24224"
    restart: unless-stopped

Step 3 — Start the stack

docker compose up -d

Generate some traffic to your app, then check LogFlow → Live Tail to see the logs arrive.

Tagging logs by container

To identify which container a log came from, Fluent Bit can add the container name as a field. Add this to your fluent-bit.conf:

[FILTER]
    Name     record_modifier
    Match    *
    Record   service ${TAG}

This sets the service field in every log to the Fluent Bit tag (which we set to api, worker, etc. in docker-compose), so you can filter by service in LogFlow.

Verify logs are arriving

In LogFlow's Logs Explorer, filter by your container names:

service:api
service:worker

Or use the CLI to tail in real time:

logflow tail --service api
logflow tail --service worker

FAQ

Do I need Fluent Bit if I use the SDK? No. The SDK sends logs directly to LogFlow over HTTPS. Fluent Bit is only needed when you can't touch the application code.

How do I handle log rotation in Docker? Docker's default json-file logging driver rotates logs automatically. With Fluent Bit using the forward driver, logs are streamed in real time and don't rely on files.

Can I filter which logs are forwarded? Yes. Add a [FILTER] block in Fluent Bit to drop or modify records before forwarding. For example, to drop health check logs:

[FILTER]
    Name    grep
    Match   *
    Exclude log /health