Docker duplicates the records of a container in both logstash and syslog.

I have a docker daemon with the default log driver configured to syslog and a dozen containers with --log-driver gelf --log-opt gelf-address = udp: //192.168.x.x: 12201 where 192.168.x.x: 12201 is logstash.

The records of one of the containers (and only one specific contrainer) end in both syslog and ELK. The container starts with the following command line from systemd:

/ usr / bin / docker run - application name - gelf -log-driver
--log-opt gelf-address = udp: //192.168.x.x: 12201 
-p 192.168.x.x: Y: Y 
-v / mnt / incoming: / mnt / incoming 

The only interesting thing is that in syslog the entries in this container have name of the program as stevedore Instead of usual container hash.

docker window version is 5: 18.09.0 ~ 3-0 ~ debian-stretch but it had the same
behavior before this version too.