How do I connect logs from Docker containers to Tares?

Tares tails a running container’s logs with the docker_logs connector, one event per line, once you create a source that names the container. Pick a primary label such as service so the lines join that service’s timeline. Open the source in the console to see the lines arrive on the next poll.

How it works

• The docker_logs connector is a poll connector. taresd reads the container’s logs every poll interval, for example 5s, and stores one event per log line. All lines are kept by default.
• match keeps only lines that match a regex, such as ERROR|WARN. drop skips lines that match a regex, such as HTTP/1.1" to drop access logs.
• label_pattern takes a regex with named groups and turns them into per-line label context.
• The primary label is the key of the source. When your metrics and alerts sources carry the same primary label, for example service, the logs land on the same timeline as them. The AI SRE guide builds this correlation end to end.
• The connector supports discovery. Discover in the console lists your running containers, and the discover_docker tool scans the whole local Docker environment and proposes one source per candidate container.

The full field list is on the Docker logs connector page.

Set it up

1. Give taresd access to the Docker daemon. Run taresd on the host, or mount the Docker socket and include the Docker CLI in the image. Tares needs the same access that docker logs needs.

2. Start Tares and open the console.

   tares up

3. Go to Sources, Add source, docker_logs and set container to the container name, or the compose service name. Click Discover to pick from the running containers. If the container runs under Compose without a fixed container_name, set container to the service name and set compose_file to an absolute path, or a path relative to where the daemon runs, so the tail follows restarts.

4. Add a label and mark it primary. A constant such as service: api-server works well because it matches the label on your other sources.

5. Save the source. The same source as YAML looks like this, and you can send the same object with POST /api/sources:

   - name: logs
     connector: docker_logs
     poll: 5s
     config:
       container: tares-demo-api-server   # the container name (docker ps)
       labels:
         - { name: service, const: api-server, primary: true }

6. Check that lines arrive. Open the source in the console. Recent events shows lines on the next poll. If nothing shows up, confirm that taresd can run docker logs for that container.

You can also ask a connected agent to do the setup: “Use tares to find my running containers and ingest the api-server’s logs.” The agent calls discover_docker or discover_source, dry-runs with test_source, which tails a few lines, and then calls create_source.

What you get

• One event per log line from the container, visible under Recent events on the source.
• A source keyed by your primary label, so the logs sit on one timeline with the metrics and alerts for the same service.
• Optional noise control: match keeps the lines you care about and drop removes the ones you do not, such as access logs.
• Evidence that triggers and agents can use. In the AI SRE guide, the demo_logs source is a docker_logs source, and the agent that wakes on an alert reads those request logs next to the metrics and alerts.

When something else fits

Use docker_logs when taresd can reach the Docker daemon and your logs come from a container on that host. If your logs live elsewhere, the connectors index lists the other routes:

• Loki: the Loki connector selects log lines with a LogQL query and polls every 5 seconds by default. It works with Grafana Cloud too.
• Vercel: point a Vercel log drain at the ingest URL of a Vercel source.
• OpenTelemetry: set OTEL_EXPORTER_OTLP_ENDPOINT to your Tares address, and the OTLP connector receives logs, traces and metrics over OTLP/HTTP.

The OTLP route fits when your services already export OpenTelemetry, and it avoids needing Docker access from taresd. In every case, give the source the same primary label as your other signals so the logs join the same timeline.

Related