title: How to capture multiple log streams from a single Docker container?
body: <p>Let's say I have a Java web app deployed in Docker, with several components producing logs within the container:</p>
  
  <ul>
  <li>Web application itself, logging to <code>STDOUT</code> and <code>STDERR</code></li>
  <li>Application server, logging to <code>server.log</code></li>
  <li>JVM, logging GC events to <code>gc.log</code></li>
  <li>Others, e.g. underlying Linux OS</li>
  </ul>
  
  <p>The application logs are routed to Splunk, but how should we retrieve logs for other components?</p>
  
  <p>It seems there are at least two options:</p>
  
  <ul>
  <li>Log everything to <code>STDOUT</code>. Not ideal as this mixes logs and produces output that is more complex to separate, as different components produce logs in different formats.</li>
  <li>Use sidecar containers for each process other than the main process, and have those sidecars retrieve the logs from e.g. <code>server.log</code> and <code>gc.log</code>, and pipe them to <code>STDOUT</code>. Better, but this can have a significant impact on disk usage.</li>
  </ul>
  
  <p>Is there a better solution?</p>