Monitor Container Uptime Status

Track Docker container uptime by container name

This is a query example for the Container Uptime widget in the Docker Overview dashboard of the docker/metrics package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4

logscale

docker.container.status = "U*"
|groupby(["container.name","docker.container.status"])
|_count>1
|drop(_count)
|rename("container.name",as="container name")
|rename("docker.container.status",as="docker status")

Introduction

This widget is used to monitor Docker container uptime status across different containers, providing visibility into how long each container has been running and helping identify potential stability issues.

In this widget, the groupBy() function aggregates container uptime information by container.name and docker.container.status. The query filters for running containers, groups the data, and formats the output for better readability.

Example incoming data might look like this:

@timestamp	#repo	#type	@id	@ingesttimestamp	@rawstring	@timezone	@type	_datagen_identifier	agent.type	agent.version	container.id	container.image.name	container.name	docker.container.event.action	docker.container.event.actor.id	docker.container.event.from	docker.container.event.status	docker.container.event.type	docker.diskio.read.bytes	docker.diskio.read.ops	docker.diskio.summary.bytes	docker.diskio.summary.ops	docker.diskio.write.bytes	docker.diskio.write.ops	docker.event.action	docker.healthcheck.event.end_date	docker.healthcheck.event.exit_code	docker.healthcheck.failingstreak	docker.healthcheck.status	docker.image.created	docker.image.id.current	docker.image.id.parent	docker.image.size.regular	docker.image.size.virtual	docker.image.tags[0]	docker.info.containers.paused	docker.info.containers.running	docker.info.containers.stopped	docker.info.containers.total	docker.info.id	docker.info.images	event.dataset	event.module	host.name	metricset.name	service.type
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_11_1773124881	2026-03-10T06:41:21	{"docker.image.id.current":"sha256:abcd1234efgh5678","metricset.name":"image","docker.image.size.regular":"133169152","docker.image.created":"2026-03-10T06:41:21.002Z","event.module":"docker","docker.image.tags":["nginx:latest"],"@timestamp":"2026-03-10T06:41:21.002Z","host.name":"docker-host-01","agent.type":"metricbeat","@type":"docker","event.dataset":"docker.image","agent.version":"7.11.1","docker.image.size.virtual":"133169152","docker.image.id.parent":"sha256:parent1234567890ab","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.11.1																				2026-03-10T06:41:21.002Z	sha256:abcd1234efgh5678	sha256:parent1234567890ab	133169152	133169152	nginx:latest							docker.image	docker	docker-host-01	image	docker
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_12_1773124881	2026-03-10T06:41:22	{"@timestamp":"2026-03-10T06:41:21.801Z","event.module":"docker","host.name":"docker-host-02","container.image.name":"nginx:latest","agent.type":"metricbeat","metricset.name":"event","docker.event.action":"stop","docker.container.event.action":"start","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.container.event.type":"container","docker.container.event.from":"redis:6.2-alpine","container.id":"a1b2c3d4e5f6","container.name":"nginx-web","event.dataset":"docker.event","docker.container.event.status":"Up 2 hours","@type":"docker","agent.version":"7.12.0","docker.container.event.actor.id":"b2c3d4e5f6a7"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.12.0	a1b2c3d4e5f6	nginx:latest	nginx-web	start	b2c3d4e5f6a7	redis:6.2-alpine	Up 2 hours	container							stop																	docker.event	docker	docker-host-02	event	docker
2026-03-10T06:41:22	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_13_1773124882	2026-03-10T06:41:23	{"docker.info.containers.paused":"0","docker.info.images":"15","metricset.name":"info","docker.info.containers.running":"5","agent.type":"metricbeat","host.name":"docker-host-03","event.module":"docker","@timestamp":"2026-03-10T06:41:22.581Z","agent.version":"7.13.2","@type":"docker","event.dataset":"docker.info","docker.info.containers.stopped":"2","docker.info.containers.total":"7","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.info.id":"ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.13.2																										0	5	2	7	ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456	15	docker.info	docker	docker-host-03	info	docker
2026-03-10T06:41:23	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_14_1773124883	2026-03-10T06:41:24	{"container.id":"c3d4e5f6a7b8","container.name":"redis-cache","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.healthcheck.failingstreak":"0","@type":"docker","event.dataset":"docker.healthcheck","agent.version":"7.14.0","agent.type":"metricbeat","container.image.name":"postgres:14","event.module":"docker","@timestamp":"2026-03-10T06:41:23.389Z","host.name":"swarm-manager-01","docker.healthcheck.status":"healthy","docker.healthcheck.event.end_date":"2026-03-10T06:41:23.389Z","metricset.name":"healthcheck","docker.healthcheck.event.exit_code":"0"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.14.0	c3d4e5f6a7b8	postgres:14	redis-cache													2026-03-10T06:41:23.389Z	0	0	healthy													docker.healthcheck	docker	swarm-manager-01	healthcheck	docker
2026-03-10T06:41:24	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_15_1773124884	2026-03-10T06:41:24	{"container.id":"d4e5f6a7b8c9","container.name":"postgres-db","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","docker.diskio.read.ops":"125","docker.diskio.read.bytes":"1048576","docker.diskio.summary.bytes":"3145728","@type":"docker","event.dataset":"docker.diskio","docker.diskio.write.bytes":"2097152","agent.version":"7.15.1","docker.diskio.write.ops":"234","agent.type":"metricbeat","container.image.name":"mongo:5.0","event.module":"docker","@timestamp":"2026-03-10T06:41:24.187Z","host.name":"swarm-worker-01","docker.diskio.summary.ops":"359","metricset.name":"diskio"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.15.1	d4e5f6a7b8c9	mongo:5.0	postgres-db						1048576	125	3145728	359	2097152	234																		docker.diskio	docker	swarm-worker-01	diskio	docker

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
docker.container.status = "U*"
```
Filters for containers where docker.container.status starts with "U" (Up).
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|groupby(["container.name","docker.container.status"])
```
Groups the events by container.name and docker.container.status, aggregating uptime information for each container.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|_count>1
```
Filters to show only containers that have multiple status entries in the _count field.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 4 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|drop(_count)
```
Drops the _count field from the results for cleaner output display.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 5 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|rename("container.name",as="container name")
```
Renames the field container.name to container name for better readability.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} 3[/Filter/] 4[/Drop Field\] 5[\Update Field Data\] 6[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> 5 5 --> 6 6 --> result style 4 fill:#2ac76d; style 5 fill:#ffbf00; style 6 fill:#ffbf00; click 4 #examples-docker-metrics-23e54762-b8d9-479e-92cf-49826f840957-4 style 6 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|rename("docker.container.status",as="docker status")
```
Renames the field docker.container.status to docker status for better readability.
Event Result set.

Summary and Results

The widget is used to monitor and display the uptime status of Docker containers in the environment, showing how long each container has been running.

This widget is useful to track container availability, identify potential stability issues, and maintain operational awareness of container states.

Sample output from the incoming example data:

container name	docker status
grafana-dashboard	Up 12 hours
grafana-dashboard	Up 30 minutes
kibana-ui	Up 1 hour
kibana-ui	Up 5 minutes

The output displays multiple uptime entries for each container, showing the duration in the docker status field and container identification in the container name field.

Versions of this Page

Examples Library