There is a lot going around docker logging, with merged/closed PRs, here is a collection:

Merged

• #12391 syslog format: "docker/ID", and use syslog.LOG_DAEMON (old: syslog.LOG_USER)
• #12668 Add tag option to syslog
• #12422 Adding --log-opt=[] to configure --log-driver=
• #13392 Add syslog-address log-opt --log-opt syslog-address=tcp://127.0.0.1:514
• #13672 Add syslog-tag log-opt
  • --log-opt syslog-address=[tcp|udp]://host:port
  • --log-opt syslog-address=unix://path
  • --log-opt syslog-tag="mailer"
• #13015 The driver sends log messages to a GELF endpoint (e.g. Graylog or Logstash/ELK) via UDP. --log-driver=gelf --log-opt gelf-address=udp://192.168.0.42:12201
• #12557Add journald as a supported logger for containers --log-driver=journald -#12865 Add container_id/container_name to journald message. see: docs on logging/jounald

Open

• #11485 Rollover driver --logging-driver rollover --log-driver-opts max_size=1k --log-driver-opts file_count=10
• #12876 Fluentd driver

Closed (but promising)

• #12790 Allow log streaming independent of log driver. Aka ringbuffer for solving race condition for logspout original commit

Logspout

logstah adapter

Relevant PRs on logspout:

• #94 Use /attach in case /logs is disabled, like if you use --log-driver=none
• #48 include syslog server to listen on udp/socket

Dockerized Syslog

If you want to run a syslogd in a container: https://registry.hub.docker.com/u/factorish/syslog/