How do I ask an AI agent for recent lines from logs from Docker containers?

Tares lets you ask any MCP client, such as Claude Code, Codex or Cursor, what happened to a service in the last 15 minutes and answers from the logs of your Docker containers. The client calls the read tool, which returns one correlated, time-ordered timeline that includes the log lines from your docker_logs source. You tail the container with the docker_logs connector, connect the client to the Tares MCP endpoint, and ask in plain language.

How it works

The docker_logs connector tails a running container’s logs into Tares, one event per line. All lines are kept by default, and you can narrow them with optional match and drop regex filters.

An MCP client connected to Tares discovers the Tares tools. When you ask about a service, the client calls read. That tool returns a correlated, time-ordered timeline across all sources that match a label selector (strict AND), and project or sources can narrow it. Your container’s log lines sit in that timeline next to metrics, alerts and findings, so one answer covers what the logs said and what else changed around them.

The label you ask about comes from your source. In the example below the source carries the label service with the value api-server, so a question about api-server finds those lines. The MCP endpoint depends on where Tares runs:

• Your machine (tares up): http://localhost:8788/mcp, after you start the MCP server as a second process.
• Your own server: https://<your-domain>/mcp.
• Tares Cloud: the endpoint shown under Connect in your console.

The client side is covered on the Connecting agents (MCP) page. This setup is one piece of AI SRE with Tares.

Set it up

1. Start Tares on a machine that can reach the Docker daemon. Run taresd on the host, or mount the Docker socket and include the Docker CLI in the image.

   tares up

2. Add the container as a source. You can ask a connected agent, “Use tares to find my running containers and ingest the api-server’s logs.” The agent calls discover_docker, then test_source to dry-run, then create_source. Or go to Sources → Add source → docker_logs in the console, or save this YAML. Set container to the container name from docker ps.

   - name: logs
     connector: docker_logs
     poll: 5s
     config:
       container: tares-demo-api-server   # the container name (docker ps)
       labels:
         - { name: service, const: api-server, primary: true }

   If the container runs under Compose without a fixed container_name, set container to the service name and add compose_file, an absolute path or one relative to where the daemon runs, so the tail follows restarts.

3. On a local Tares, the daemon alone does not serve /mcp, so start the MCP server as a second process. On a server or Tares Cloud instance it is already running.

   tares mcp --transport streamable-http --port 8788 --taresd http://localhost:8787

4. Connect your client. For Claude Code, the CLI route is:

   claude mcp add --transport http tares http://localhost:8788/mcp

   Codex, Cursor, Claude Desktop and other MCP clients connect with the same endpoint, and each snippet is on the agents page. For a secured remote instance, the client sends an Authorization: Bearer header holding an API key, and a key with the read scope is enough for this question.

5. Verify the connection. Ask your client, “Use tares: what are you ingesting right now?” It calls catalog_list and lists your sources, including the docker_logs one.

6. Ask for the recent lines: “What happened to api-server in the last 15 minutes?” The client calls read and answers from the timeline, with the log lines included.

If nothing shows up, open the source in the console. Recent events shows lines on the next poll. Also check that taresd can run docker logs for the container, which is the same access the connector needs.

What you get

• A plain-language answer about the last quarter hour of a service, built from one read call instead of a pile of docker logs output.
• Log lines in context. Metrics, alerts and findings for the same label appear in the same time-ordered timeline.
• Less noise when you want it. Use match to keep only lines such as ERROR|WARN, or drop to skip access logs.
• The same answers from any MCP client you already use, with the same source and the same endpoint.
• A visible trail. In the console, Reads lists each read as it happens, tagged client = mcp.

When something else fits

• If you want to chat without wiring up an external client, use Ask in the Tares console, which has the same read tools hosted inside Tares.
• If you only want to check that lines arrive, open the source in the console and look at Recent events. The Docker logs connector page has the full field list.
• If a client supports only stdio servers, the agents page describes the stdio transport and a bridge to the HTTP endpoint.

Related