How do I confirm lines from logs from Docker containers are arriving in Tares?

Tares shows arriving Docker container logs in two places: the source’s Recent events in the console, and the service’s timeline when an agent reads it. The docker_logs source polls every 5 seconds in the example, so lines appear on the next poll. Check the source first, then read the service from an agent to see the same lines on its timeline.

How it works

A docker_logs source tails a running container’s logs and stores one event per line. Tares polls the container on the poll interval, 5s in the example below. Every event carries the labels you set on the source, and the primary label is the key that places the lines on that service’s timeline.

You can check arrival at two levels:

• The source. Its Recent events list shows the lines Tares ingested on the latest polls. This tells you the connector works.
• The service timeline. An agent that reads the service gets the lines merged with the service’s other sources on one clock. This tells you the labels are right and the lines reach the agent.

The source’s Fields tab shows the actual coverage of each label field, which helps when lines arrive but do not land on the service you expect. The Docker logs page describes the connector in full, and the Connectors index covers labels and modes for every connector.

Set it up

1. Create the source. In the console, go to Sources → Add source → docker_logs, set container to the container name and save. You can also declare it as YAML or ask a connected agent to set it up. The example below keys the lines to a service named api-server:

- name: logs
  connector: docker_logs
  poll: 5s
  config:
    container: tares-demo-api-server   # the container name (docker ps)
    labels:
      - { name: service, const: api-server, primary: true }

2. Wait for one poll, then open the source in the console. Recent events shows the container’s lines.

3. Open the source’s Fields tab and check that the service label has coverage. A label with no coverage means lines are not reaching the timeline under the service you expect.

4. Start the MCP endpoint in a second shell so an agent can read the service:

tares mcp

5. Connect your MCP client and ask it to read the service:

Use tares: what happened to api-server in the last 15 minutes?

The client calls read with the service set to api-server and answers from the correlated timeline. Your container’s lines appear in that answer.

6. For a visual check, open Explore in the console and pick the service. The log lines appear on the timeline next to the service’s other sources.

If you run Tares with tares up, the console is at http://127.0.0.1:8787.

What you get

• Proof at the source level that Tares is tailing the container, from Recent events.
• Proof at the service level that the lines are labeled correctly and reach an agent, from the read answer and the Explore timeline.
• A Fields tab that shows which label fields your lines actually fill.
• A setup you can reuse. Once the lines show up, the same service timeline feeds triggers and agents, as in the AI SRE guide.

When something else fits

• If Recent events stays empty after a poll, check that taresd has access to the Docker daemon. Run taresd on the host, or mount the Docker socket and include the Docker CLI in the image.
• If your logs come from an OpenTelemetry pipeline instead of a container on the host, the OTLP connector fits better. See the Connectors index for all options.

Related