I have a docker daemon with the default log driver configured to
syslog and a dozen containers with
--log-driver gelf --log-opt gelf-address = udp: //192.168.x.x: 12201 where 192.168.x.x: 12201 is logstash.
The records of one of the containers (and only one specific contrainer) end in both syslog and ELK. The container starts with the following command line from
/ usr / bin / docker run - application name - gelf -log-driver --log-opt gelf-address = udp: //192.168.x.x: 12201 -p 192.168.x.x: Y: Y -v / mnt / incoming: / mnt / incoming request
The only interesting thing is that in syslog the entries in this container have
name of the program as
stevedore Instead of usual container hash.
docker window version is
5: 18.09.0 ~ 3-0 ~ debian-stretch but it had the same
behavior before this version too.