Docker Collector

Docker Collector is a purpose-built agent designed to collect logs from Docker containers and forward them efficiently to Falcon LogScale Collector. It supports multiple collection methods including Docker logging drivers, direct container log file monitoring, and the Docker API.

The collector automatically discovers running containers and begins collecting their logs without manual configuration. It enriches log events with container metadata including container name, image, labels, and environment variables.

Data Flow

The following diagram shows how Docker container logs flow through Log Collector's ingestion pipeline:

flowchart LR A[Docker Containers] --> B[LogScale Docker Collector] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Docker JSON Parser] D --> D2[Container Log Parser] D --> D3[Kubernetes Metadata Parser] D --> D4[Multi-line Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Docker Containers] --> B[LogScale Docker Collector] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Docker JSON Parser] D --> D2[Container Log Parser] D --> D3[Kubernetes Metadata Parser] D --> D4[Multi-line Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

With its container-native design and low overhead, Docker Collector is optimized for containerized environments where traditional file-based log collection may be impractical.