I am trying to troubleshoot docker container that should send logs to Kibana using GELF log driver. The container is configured with docker-compose.yml below.

      driver: gelf
        gelf-address: udp://

Because of the logging driver I can not see the messages when I issue docker logs.

$ docker logs app_1
Error response from daemon: configured logging driver does not support reading

I thought I can read the logs without restarting server by inspect UDP packets that this GELF driver sends with tshark. However I need to figure out exact command.

It is possible to see the list of available dissectors, but there is nothing for the GELF format.

tshark -d udp.port==12201

Any hints how to inspect GELF traffic with tshark?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.