Skip to main content
In Docker, logging drivers determine how container and service logs are captured, formatted, and stored. By choosing the right logging driver, you can centralize logs, integrate with external systems, and manage log retention efficiently. You can always view a container’s output with: 
docker logs <container-name>
but behind the scenes the logging driver dictates where and how those logs are persisted.
The image features the text "Logging Drivers" on a dark background with abstract circular shapes and a wavy purple and blue design at the bottom.

​
What Is the Default json-file Logging Driver?

Docker’s default logging driver is json-file. It collects container output and writes it as JSON objects on the host filesystem. To confirm your daemon’s default driver: 
docker system info
Look for: 
Server:
  ...
  Logging Driver: json-file
  Cgroup Driver: cgroupfs
Plugins:
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Run and inspect logs under json-file: 
docker run -d --name nginx nginx
docker logs nginx
Sample output: 
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Configuration complete; ready for start up

​
Where Are json-file Logs Stored?

By default, log files are stored under /var/lib/docker/containers/<container-id>. Each container directory contains a file named <container-id>-json.log: 
docker ps
cd /var/lib/docker/containers
ls
cat f3997637c0df66becf4dd4662d3c172bf16f916a3b9289b95f0994675102de17-json.log
Rotating or cleaning up old JSON logs prevents disk exhaustion. Consider using Docker’s log-opts settings like max-size and max-file.

​
Supported Docker Logging Drivers

Beyond json-file, Docker integrates with multiple logging backends. Choose the one that matches your infrastructure for centralized log aggregation:
DriverUse CaseMore Info
awslogsSend logs to Amazon CloudWatch LogsAWS CloudWatch Logs
fluentdForward logs to a Fluentd collectorFluentd
gcplogsShip logs to Google Cloud LoggingGoogle Cloud Logging
gelfGraylog Extended Log FormatGELF Specs
journaldUse systemd’s journaldjournald
splunkForward to SplunkSplunk Docs
syslogStandard syslog protocol—
localFast, built-in local driver—
noneDisable logging (no docker logs)—
Using the none driver disables all logs for the container. Only use this when you intentionally want zero log output.

​
Changing the Daemon’s Default Logging Driver

To set a different default logging driver, modify (or create) /etc/docker/daemon.json: 
{
  "log-driver": "awslogs",
  "log-opts": {
    "awslogs-region": "us-east-1"
  }
}
If you need TLS, custom hosts, or debug mode, include those settings alongside: 
{
  "debug": true,
  "hosts": ["tcp://0.0.0.0:2376"],
  "tls": true,
  "tlscert": "/var/docker/server.pem",
  "tlskey": "/var/docker/serverkey.pem",
  "log-driver": "awslogs",
  "log-opts": {
    "awslogs-region": "us-east-1"
  }
}
Restart Docker to apply changes: 
sudo systemctl restart docker

​
Overriding the Logging Driver Per Container

You can override the daemon default for individual containers with the --log-driver flag: 
docker run -d \
  --name myapp \
  --log-driver=fluentd \
  nginx
Add driver-specific options via --log-opt: 
docker run -d \
  --name myapp \
  --log-driver=fluentd \
  --log-opt fluentd-address=localhost:24224 \
  nginx

​
Inspecting a Container’s Logging Configuration

To verify which logging driver a container is using: 
docker container inspect nginx
Search for the HostConfig.LogConfig section: 
"HostConfig": {
  "LogConfig": {
    "Type": "json-file",
    "Config": {}
  }
}
For a concise output with a Go template: 
docker container inspect -f '{{.HostConfig.LogConfig.Type}}' nginx
This prints only the driver name.

Watch Video