Docker Log InputΒΆ

New in version 0.8.

Plugin Name: DockerLogInput

The DockerLogInput plugin attaches to all containers running on a host and sends their logs messages into the Heka pipeline. The plugin is based on Logspout by Jeff Lindsay. Messages will be populated as follows:

  • Uuid: Type 4 (random) UUID generated by Heka.
  • Timestamp: Time when the log line was received by the plugin.
  • Type: DockerLog.
  • Hostname: Hostname of the machine on which Heka is running.
  • Payload: The log line received from a Docker container.
  • Logger: stdout or stderr, depending on source.
  • Fields[“ContainerID”] (string): The container ID.
  • Fields[“ContainerName”] (string): The container name.


Logspout expects to be dealing exclusively with textual log file data, and always assumes that the file data is newline delimited, i.e. one line in the log file equals one logical unit of data. For this reason, the DockerLogInput currently does not support the use of alternate splitter plugins. Any splitter setting specified in a DockerLogInput’s configuration will be ignored.


  • endpoint (string):

    A Docker endpoint. Defaults to “unix:///var/run/docker.sock”.

  • decoder (string):

    The name of the decoder used to further transform the message into a structured hekad message. No default decoder is specified.

New in version 0.9.

  • cert_path (string, optional):

    Path to directory containing client certificate and keys. This value works in the same way as DOCKER_CERT_PATH.

New in version 0.10.

  • name_from_env_var (string, optional):

    Overwrite the ContainerName with this environment variable on the Container if exists. If left empty the container name will still be used.

  • fields_from_env (array[string], optional):

    A list of environment variables to extract from the container and add as fields.

New in version 0.11.

  • since_path (string, optional):

    Path to file where input will write a record of the “since” time for each container to be able to not miss log records while Heka is down (see Dockers Get container logs API). Relative paths will be relative to Heka’s configured base_dir. Defaults to ${BASE_DIR}/docker/logs_since.txt

  • since_interval (string, optional):

    Time interval (as supported by Go’s time.ParseDuration API) that specifies how often the DockerLogInput will write out the “since” file containing the most recently retrieved log times for each container. Defaults to “5s”. If set to zero (e.g. “0s”) then the file will only be written out when Heka cleanly shuts down, meaning that if Heka crashes all container logs written since Heka has started will be re-fetched.


type = "SandboxDecoder"
filename = "lua_decoders/nginx_access.lua"

type = "nginx.access"
user_agent_transform = true
log_format = '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"'

decoder = "nginx_log_decoder"
fields_from_env = [ "MESOS_TASK_ID" ]