Why do no log lines arrive from my docker_logs source?

Tares shows your container’s log lines under Recent events on the next poll, as long as taresd can run docker logs for that container. If nothing arrives, check that access first. Run taresd on the host, or mount the Docker socket and include the Docker CLI in the image. Then review the container name and the filters in your source. The Docker logs connector page has the full reference.

How it works

The docker_logs connector tails a running container’s logs and turns each line into one event. It keeps all lines by default. You can narrow that with the optional match and drop regex filters.

taresd does the tailing, so it needs access to the Docker daemon. It is the same access that docker logs needs for your container. You get that access in one of two ways:

• Run taresd on the host, where it can reach the daemon directly.
• Run taresd in a container, mount the Docker socket into it and include the Docker CLI in the image.

The source polls on the interval you set, for example poll: 5s. After the next poll, new lines appear under Recent events on the source in the console.

Three settings in the source config decide which container is tailed and which lines are kept:

• container is the container name, as docker ps shows it, or the Compose service name.
• compose_file is the path to your docker-compose.yml. Set it when the container runs under Compose without a fixed container_name, so the tail follows restarts. Use an absolute path, or one relative to where the daemon runs.
• match keeps only lines that match a regex, and drop skips lines that match a regex.

This is part of how Tares brings runtime signals into AI SRE.

Set it up

1. Open the source in the console and look at Recent events. Lines show there on the next poll. If the list stays empty, continue with the steps below.
2. Confirm taresd can reach the Docker daemon. If you run taresd on the host, it has that access. If you run taresd in a container, mount the Docker socket and use an image that includes the Docker CLI. taresd must be able to run docker logs for your container.
3. Check the container value. It must be the name of a running container, as docker ps lists it. In the console, Sources → Add source → docker_logs has a Discover button that lists the running containers to pick from.
4. If the container runs under Compose, set container to the service name and add compose_file.
5. Review match and drop. A match regex that nothing satisfies keeps no lines. A broad drop regex skips the lines you want.
6. Run a dry run. A connected agent can call test_source, which tails a few lines without saving anything. Ask it: “Use tares to find my running containers and ingest the api-server’s logs.” The agent calls discover_docker to scan your running containers and propose one source per candidate, then test_source, then create_source.
7. Save the source and watch Recent events for the next poll.

A working source looks like this:

- name: logs
  connector: docker_logs
  poll: 5s
  config:
    container: tares-demo-api-server   # the container name (docker ps)
    labels:
      - { name: service, const: api-server, primary: true }

You can also create the same object with POST /api/sources.

What you get

• Each line from the container arrives as one event under Recent events on the next poll.
• The match and drop filters let you keep only the lines you care about, for example ERROR|WARN, or skip access logs.
• Compose containers keep being tailed across restarts when you set compose_file.
• The service label from your config sits on every event, so you can tell which container a line came from.
• label_pattern takes a regex with named groups and turns each group into per-line label context.

When something else fits

• If you cannot give taresd access to the Docker daemon, send the logs another way. The otlp connector receives OpenTelemetry logs over OTLP/HTTP.
• If the logs you want are not in a container on the machine where taresd runs, docker_logs is not the right connector for them.

Related