How to Use the Docker Logs Command
The docker logs command is an essential diagnostic utility that displays everything a container outputs to standard output (stdout) and standard error (stderr). It is particularly useful when troubleshooting failed startups, analyzing runtime behavior, or reviewing error details. This tool provides direct access to container activity without needing to attach or exec into the container.
While docker logs focuses on application output, it works best when used together with commands like docker inspect and docker exec, which deliver metadata and interactive shell access. This guide explains how to use docker logs for inspecting, streaming, and filtering container logs so you can efficiently detect and resolve issues.
Quick Reference Guide
If you’re already experienced with Docker and need a fast way to check container logs, the commands below will help:
# List all running containers to get the container ID
$ docker container ls
# View logs from a container
$ docker logs <container_id>
# Stream logs in real time
$ docker logs -f <container_id>
# View the last 100 lines of logs
$ docker logs --tail 100 <container_id>
# View logs since a specific time
$ docker logs --since="2025-05-20T10:00:00" <container_id>
# View logs until a specific time
$ docker logs --until="2025-05-20T12:00:00" <container_id>
# View logs with timestamps
$ docker logs --timestamps <container_id>
These examples demonstrate the most common ways of checking and filtering logs. Continue reading for detailed explanations and demonstrations.
Viewing Container Logs
The docker logs command shows output written to a container’s stdout and stderr. This includes application logs, initialization details, and error messages, all of which are vital for diagnosing issues.
Command Syntax
docker logs <container_id>
- docker logs: Outputs the complete stdout and stderr logs.
- <container_id>: The container’s short or full ID, which you can find by running docker container ls.
Use Case
- Shows all logs since the container started.
- Does not affect or stop the running container.
- Useful for confirming successful service initialization, checking errors, or investigating runtime issues.
Command Example
First, list the running containers:
$ docker container ls
Example output:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ea45fa0f96ac nginx "/docker-entrypoint.…" 44 seconds ago Up 44 seconds 80/tcp web
Now, view the container logs by referencing its ID or name:
$ docker logs ea45fa0f96ac
Example log output:
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
...
2025/05/28 20:44:38 [notice] 1#1: start worker process 29
Streaming Logs in Real Time
To keep watching logs as they are generated, use the -f or --follow flag. This keeps the session active and streams logs continuously. It’s especially helpful for monitoring live services or ongoing processes.
Command Syntax
docker logs -f <container_id>
- docker logs: Displays stdout and stderr logs.
- -f or –follow: Streams logs as new entries appear.
- <container_id>: Container ID (short or full).
Use Case
- Streams logs continuously until stopped with Ctrl + C.
- Helps monitor background tasks, web traffic, or active deployments.
- Great for verifying a container’s real-time responses.
Command Example
List running containers:
$ docker container ls
Stream logs from a container:
$ docker logs -f 8f8f72f26159
This streams logs in real time from the container. To stop streaming, press Ctrl + C.
Filtering Logs by Time and Lines
You can refine log output with specific flags that reduce clutter and target relevant events. These filters let you focus on logs from a certain time frame or extract only the most recent lines.
Log Filtering Options
| Flag | Requires Value | Type | Description |
|---|---|---|---|
| –tail | Yes (number) | Integer | Shows only the last n lines |
| –since | Yes (timestamp) | String | Displays logs from a specific time onward |
| –until | Yes (timestamp) | String | Displays logs before a given time |
| –timestamps | No | Boolean | Adds ISO 8601 timestamps to log entries |
These options can be combined with docker logs for precise troubleshooting. Below are examples for each.
Show Recent Logs with –tail
Command Syntax
docker logs --tail <number_of_lines> <container_id>
- –tail: Limits output to the last n lines (e.g., 10, 100, 500).
- <container_id>: Container ID (short or full).
Use Case
- Shows only recent log entries.
- Reduces unnecessary scrolling through long logs.
- Perfect for quickly checking recent activity.
Command Example
Get running containers:
$ docker container ls
Now display the last 10 lines:
$ docker logs --tail 10 ea45fa0f96ac
Example output:
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
...
2025/05/28 20:44:38 [notice] 1#1: start worker process 29
View Logs Since a Specific Time with –since
Command Syntax
docker logs --since="<timestamp>" <container_id>
- –since: Displays logs starting from a specific time.
- Accepts ISO timestamps (e.g., 2025-05-20T10:00:00) or relative values (e.g., 30m, 2h, 1d).
Use Case
- Filters logs generated after a particular point in time.
- Helps isolate logs relevant to specific events or tests.
- Supports both relative and absolute timestamps.
Command Example
First, list containers:
$ docker container ls
Show logs from a fixed timestamp:
$ docker logs --since="2025-05-27T10:00:00" ea45fa0f96ac
This outputs logs from the specified time onward.
View logs from the last 30 minutes:
$ docker logs --since="30m" ea45fa0f96ac
This filters logs to display only the last 30 minutes of activity.
View Logs Until a Specific Time with –until
Command Syntax
docker logs --until="<timestamp>" <container_id>
- docker logs: Displays stdout and stderr from the container.
- –until: Shows logs created before a specified time (absolute like 2025-05-20T12:00:00 or relative like 30m, 2h).
- <container_id>: The container’s short or full ID.
Use Case
- Limits output to logs before a given time.
- Helps analyze system state prior to an error or crash.
- Often paired with
--sinceto create a custom time range.
Command Example
List active containers:
$ docker container ls
View logs before a specific timestamp (May 28, 2025, at 20:44:39):
$ docker logs --until="2025-05-28T20:44:39" ea45fa0f96ac
Example output:
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
...
To see logs older than two hours:
$ docker logs --until="2h" ea45fa0f96ac
This option is particularly useful when reviewing logs leading up to an outage or earlier system event.
Add Timestamps to Logs with –timestamps
Command Syntax
docker logs --timestamps <container_id>
- –timestamps: Appends ISO 8601 timestamps to each log entry.
- <container_id>: Container ID to inspect.
Use Case
- Correlates logs with application performance and error timelines.
- Helps when debugging latency or request timing issues.
- Essential when aggregating logs across multiple services.
Command Example
Identify the container and display logs with timestamps:
$ docker container ls
$ docker logs --timestamps ea45fa0f96ac
Example output:
2025-05-28T20:44:38.654359332Z /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
2025-05-28T20:44:38.664232169Z /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
2025-05-28T20:44:38.690538640Z 2025/05/28 20:44:38 [notice] 1#1: nginx/1.27.5
2025-05-28T20:44:38.690643927Z 2025/05/28 20:44:38 [notice] 1#1: OS: Linux 6.8.0-60-generic
This is particularly helpful for log correlation and integration with monitoring systems.
Handle Errors When Viewing Logs
Sometimes running docker logs may produce errors such as:
- Error: No such container: <container_id>
- Error response from daemon: permission denied
These errors typically result from incorrect container references or insufficient user permissions.
“No such container” Error
This occurs when the container ID is invalid, incomplete, or the container has already exited.
How to Fix
- List running containers:
$ docker container ls
- If the container has stopped, include all containers:
$ docker container ls -a
- Then use the correct container ID or name:
$ docker logs <valid_container_id_or_name>
Permission Denied Error
This usually occurs if the current user doesn’t have permission to access Docker.
How to Fix
- Run the command with sudo:
$ sudo docker logs <container_id>
- Or add your user to the docker group:
$ sudo usermod -aG docker $USER
Log out and back in for the changes to apply.
Conclusion
This guide explained how to effectively use the docker logs command for debugging containers. You learned how to:
- View logs from a running container.
- Stream logs in real time.
- Filter logs with
--tail,--since,--until, and--timestamps. - Resolve common errors such as invalid container IDs or permission issues.
Applying these techniques will help you quickly diagnose problems and maintain reliable Docker environments. For additional details, consult the official Docker documentation for docker logs.
