Send logs to Amazon CloudWatch Logs

Coolify's built-in Amazon CloudWatch Logs log drain sends opted-in resource logs to a CloudWatch Logs log group. It uses the Docker awslogs logging driver, so the Docker daemon on the server sends the logs directly to AWS.

Before you start

The CloudWatch drain does not use the coolify-log-drain Fluent Bit container. Coolify configures the Docker awslogs logging driver on each opted-in resource container instead.

Give Docker AWS credentials

The Docker daemon on the server reads the AWS credentials, not Coolify. Use one of these sources:

• An IAM instance profile (instance role), if the server is an Amazon EC2 instance.
• The AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables of the Docker service. Also set AWS_SESSION_TOKEN for temporary credentials.
• The shared credentials file of the root user, /root/.aws/credentials.

For example, to set environment variables for a Docker service that systemd manages, create /etc/systemd/system/docker.service.d/aws-credentials.conf:

[Service]
Environment="AWS_ACCESS_KEY_ID=<access-key-id>"
Environment="AWS_SECRET_ACCESS_KEY=<secret-access-key>"

Then reload systemd and restart Docker:

sudo systemctl daemon-reload
sudo systemctl restart docker

Set the IAM permissions

The credentials must allow these CloudWatch Logs actions:

Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

To limit the policy, replace "*" with the ARN of the log group and its log streams.

Configure CloudWatch in Coolify

Coolify accepts these values:

Enable a resource

Follow Enable log draining for a resource, then restart or redeploy the resource.

Coolify sets these awslogs options on the container:

The non-blocking mode prevents CloudWatch errors from blocking or stopping the container. If the driver cannot send logs, the container continues to run.

Log groups and log streams

• Log group: The driver creates the log group if it does not exist. This requires logs:CreateLogGroup.
• Log streams: The driver creates one log stream for each container. The stream name is the Log stream prefix value followed by the container name, for example docker/<container-name>. Without a prefix, the stream name is the container name.

The CloudWatch drain does not add the coolify.server_name or coolify.app_name fields that the Fluent Bit destinations add. Use the log stream name to identify the container.

Coolify does not set a retention period on the log group. Set the retention in CloudWatch Logs.

Verify delivery

1. Cause the resource to write a recognizable message to stdout or stderr.
2. Open CloudWatch Logs in the AWS console and select the log group and region that you entered in Coolify.
3. Open the log stream of the container and search for the message.

Verification in CloudWatch Logs is required because Coolify does not perform a provider connection test.

Update the log group, prefix, or region

1. Set Status to Disabled in the Amazon CloudWatch Logs section.
2. Update Log group, Log stream prefix, or Region.
3. Select Save changes.
4. Set Status to Enabled again.
5. Restart or redeploy the resources. Running containers keep the logging options that they had when Docker created them.
6. Generate a new resource log and confirm that it arrives in the expected log group.

Fix missing logs

1. Confirm Amazon CloudWatch Logs is the enabled server drain and the resource's Log drain setting is on.
2. Confirm you restarted or redeployed the resource after enabling the setting.
3. Confirm the Docker daemon has AWS credentials and that they allow the IAM actions in Set the IAM permissions.
4. Confirm the region in Coolify is the region where you look for the log group.
5. Confirm the container uses the awslogs driver:

docker inspect --format '{{.HostConfig.LogConfig.Type}}' <container-name>

6. Inspect the Docker daemon logs on the resource server:

journalctl -u docker --since "15 minutes ago"

Credential, permission, and network errors appear in the Docker daemon logs. They do not appear in a coolify-log-drain container, because CloudWatch does not use it.

Continue with log drains