How to: Using logspout
#### Route all container output to remote syslog

The simplest way to use logspout is to just take all logs and ship to a remote syslog. Just pass a syslog URI (or several comma separated URIs) as the command. Here we show use of the `tls` encrypted transport option in the URI. Also, we always mount the Docker Unix socket with `-v` to `/var/run/docker.sock`:

	$ docker run --name="logspout" \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		syslog+tls://logs.papertrailapp.com:55555

logspout will gather logs from other containers that are started **without the `-t` option** and are configured with a logging driver that works with `docker logs` (`journald` and `json-file`).

To see what data is used for syslog messages, see the [syslog adapter](http://github.com/gliderlabs/logspout/blob/master/adapters) docs.

The container must be able to access the Docker Unix socket to mount it. This is typically a problem when [namespace remapping](https://docs.docker.com/engine/security/userns-remap/) is enabled. To disable remapping for the logspout container, pass the `--userns=host` flag to `docker run`, `.. create`, etc. 

#### Ignoring specific containers

You can tell logspout to ignore specific containers by setting an environment variable when starting your container, like so:-

    $ docker run -d -e 'LOGSPOUT=ignore' image

Or, by adding a label which you define by setting an environment variable when running logspout:

    $ docker run --name="logspout" \
        -e EXCLUDE_LABEL=logspout.exclude \
        --volume=/var/run/docker.sock:/var/run/docker.sock \
        gliderlabs/logspout
    $ docker run -d --label logspout.exclude=true image

Logspout also allows to ignore containers by specifying a list of labels using the environment variables `EXCLUDE_LABELS` or `EXCLUDE_LABEL`, using the `;` as separator:

    $ $ docker run --name="logspout" \
        -e EXCLUDE_LABELS=k8s:app;backend:rails;io.kubernetes.pod.namespace:default \
        --volume=/var/run/docker.sock:/var/run/docker.sock \
        gliderlabs/logspout
    $ docker run -d --label k8s=app image1
    $ docker run -d --label backend=rails image2

**NOTE** Setting `EXCLUDE_LABELS` would take precedence over setting `EXCLUDE_LABEL`

#### Including specific containers

You can tell logspout to only include certain containers by setting filter parameters on the URI:

	$ docker run \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		raw://192.168.10.10:5000?filter.name=*_db
	
	$ docker run \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		raw://192.168.10.10:5000?filter.id=3b6ba57db54a
	
	$ docker run \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		raw://192.168.10.10:5000?filter.sources=stdout%2Cstderr
	
	# Forward logs from containers with both label 'a' starting with 'x', and label 'b' ending in 'y'.
	$ docker run \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		raw://192.168.10.10:5000?filter.labels=a:x*%2Cb:*y

Note that you must URL-encode parameter values such as the comma in `filter.sources` and `filter.labels`.

#### Multiple logging destinations

You can route to multiple destinations by comma-separating the URIs:

	$ docker run \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout \
		raw://192.168.10.10:5000?filter.name=*_db,syslog+tls://logs.papertrailapp.com:55555?filter.name=*_app

#### Suppressing backlog tail
You can tell logspout to only display log entries since container "start" or "restart" event by setting a `BACKLOG=false` environment variable (equivalent to `docker logs --since=0s`):

	$ docker run -d --name="logspout" \
		-e 'BACKLOG=false' \
		--volume=/var/run/docker.sock:/var/run/docker.sock \
		gliderlabs/logspout

The default behaviour is to output all logs since creation of the container (equivalent to `docker logs --tail=all` or simply `docker logs`).

> NOTE: Use of this option **may** cause the first few lines of log output to be missed following a container being started, if the container starts outputting logs before logspout has a chance to see them. If consistent capture of *every* line of logs is critical to your application, you might want to test thoroughly and/or avoid this option (at the expense of getting the entire backlog for every restarting container). This does not affect containers that are removed and recreated.

#### Environment variable, TAIL
Whilst BACKLOG=false restricts the tail by setting the Docker Logs.Options.Since to time.Now(), another mechanism to restrict the tail is to set TAIL=n.  Use of this mechanism avoids parsing the earlier content of the logfile which may have a speed advantage if the tail content is of no interest or has become corrupted.

#### Inspect log streams using curl

Using the [httpstream module](http://github.com/gliderlabs/logspout/blob/master/httpstream), you can connect with cur