I am trying to troubleshoot
docker container that should send logs to
Kibana using GELF log driver. The container is configured with
services: app: ... logging: driver: gelf options: gelf-address: udp://172.31.22.47:12000
Because of the logging driver I can not see the messages when I issue
$ docker logs app_1 Error response from daemon: configured logging driver does not support reading
I thought I can read the logs without restarting server by inspect UDP packets that this GELF driver sends with
tshark. However I need to figure out exact command.
It is possible to see the list of available dissectors, but there is nothing for the GELF format.
tshark -d udp.port==12201
Any hints how to inspect GELF traffic with