docker logs

# -----------------------------------------------
#  Basic syntax
# -----------------------------------------------

# docker logs {container ID or container name}
#   → Displays all logs for the target container
#   Example: docker logs evangelion-app

# -----------------------------------------------
#  Common options
# -----------------------------------------------

# docker logs --follow {container name}
#   → Streams logs in real time (equivalent to tail -f)
#   Example: docker logs --follow evangelion-app

# docker logs --timestamps {container name}
#   → Prepends an RFC3339Nano timestamp to each log line
#   Example: docker logs --timestamps evangelion-app

# docker logs --tail {lines} {container name}
#   → Shows only the specified number of lines from the end
#   Example: docker logs --tail 20 evangelion-app

# docker logs --since {time or relative duration} {container name}
#   → Shows only logs from the specified time onward
#   Example: docker logs --since 30m evangelion-app
#   Example: docker logs --since 2026-03-26T00:00:00 evangelion-app

# docker logs --until {time or relative duration} {container name}
#   → Shows only logs up to the specified time
#   Example: docker logs --until 2026-03-26T06:00:00 evangelion-app

# -----------------------------------------------
#  Filtering only stderr (shell redirection)
# -----------------------------------------------

# docker logs {container name} 2>&1 | grep ERROR
#   → Merges stdout and stderr, then filters with grep
#   Example: docker logs evangelion-app 2>&1 | grep ERROR

Syntax / Option	Description
docker logs {container name}	Displays all logs for the target container at once.
--follow（-f）	Streams logs in real time. Continues outputting new lines until you press Ctrl+C.
--timestamps（-t）	Prepends an RFC3339Nano timestamp to the beginning of each line.
--tail {lines}（-n）	Shows only the specified number of lines from the end. Use --tail all to show all lines.
--since {time}	Shows only logs from the specified time onward. Accepts a relative duration (e.g., 30m, 2h) or an absolute RFC3339 timestamp.
--until {time}	Shows only logs up to the specified time. Can be combined with --since to filter a time range.
--details	Also displays extra attributes passed to the log driver. Not commonly used for routine log inspection.

Display all logs for a container

# -----------------------------------------------
#  Display all logs for the evangelion-app container
# -----------------------------------------------

# Start the container first (skip this if it is already running)
docker run -d --name evangelion-app \
  -e APP_PILOT=shinji \
  nginx:alpine

# Display all logs
docker logs evangelion-app

$ docker logs evangelion-app
2026/03/26 09:00:00 [notice] 1#1: using the "epoll" event method
2026/03/26 09:00:00 [notice] 1#1: nginx/1.25.3
2026/03/26 09:00:00 [notice] 1#1: start worker processes
172.17.0.1 - - [26/Mar/2026:09:00:05 +0000] "GET / HTTP/1.1" 200 615 "-" "curl/7.88.1"

Stream logs in real time (--follow)

# -----------------------------------------------
#  Use --follow to stream logs in real time
# -----------------------------------------------

# Stream logs from the rei-server container (press Ctrl+C to stop)
docker logs --follow rei-server

$ docker logs --follow rei-server
2026/03/26 09:01:00 [notice] 1#1: start worker processes
2026/03/26 09:01:10 [notice] connected: pilot=ayanami-rei
2026/03/26 09:01:15 [notice] request received from asuka-langley
2026/03/26 09:01:20 [error] synchronization failed: unit-02 not responding
^C

Display the last 20 lines with timestamps

# -----------------------------------------------
#  Combine --timestamps and --tail
# -----------------------------------------------

# Show the last 20 lines of logs from the misato-bridge container with timestamps
docker logs --timestamps --tail 20 misato-bridge

$ docker logs --timestamps --tail 20 misato-bridge
2026-03-26T09:05:00.123456789Z launch sequence initiated by katsuragi-misato
2026-03-26T09:05:01.234567890Z unit-01 status: standby
2026-03-26T09:05:02.345678901Z unit-01 status: active — pilot: ikari-shinji
2026-03-26T09:05:10.456789012Z alert level upgraded to pattern blue
2026-03-26T09:05:15.567890123Z [ERROR] AT-field breach detected in sector 7

Filter logs by time range (--since / --until)

# -----------------------------------------------
#  Use --since to show only logs from the last 30 minutes
# -----------------------------------------------

# Show logs from the last 30 minutes
docker logs --since 30m gendo-command

# -----------------------------------------------
#  Use --since and --until to specify a time range
# -----------------------------------------------

# Retrieve only logs between 09:00 and 09:10 on 2026-03-26
docker logs \
  --since 2026-03-26T09:00:00 \
  --until 2026-03-26T09:10:00 \
  gendo-command

$ docker logs --since 30m gendo-command
2026-03-26T09:03:42.000000000Z [INFO]  scenario activated by ikari-gendo
2026-03-26T09:04:00.000000000Z [INFO]  third-impact protocol: pending
$ docker logs --since 2026-03-26T09:00:00 --until 2026-03-26T09:10:00 gendo-command
2026-03-26T09:03:42.000000000Z [INFO]  scenario activated by ikari-gendo
2026-03-26T09:04:00.000000000Z [INFO]  third-impact protocol: pending
2026-03-26T09:05:30.000000000Z [WARN]  unit-01 synchronization rate exceeded limit

'docker logs' retrieves exactly what a container has written to stdout and stderr. Logs are retained even after a container stops, and you can view them with the same command. The default log driver is json-file, which stores logs at /var/lib/docker/containers/{ID}/{ID}-json.log on the host. If a container was started with --log-driver none, no logs are saved and docker logs cannot be used. When you are streaming logs with --follow and the container stops, streaming ends automatically. In production environments, using --tail to limit the number of lines displayed can reduce the load on your terminal from large volumes of logs.

Related pages: docker run (creating and running containers) / docker ps (listing containers)