title: How can Splunk distinguish between output to stdout and stderr in Docker context?
body: <p>We have a Java application that can be run in Docker containers. It produces messages to <em>stdout</em> and <em>stderr</em> with a different level of detail for different audiences.</p>
  <p>Configuring Splunk as log driver all log lines received by Splunk a marked with source <em>stdout</em> although there must be log lines being logged to <em>stderr</em>.</p>
  <p>Splunk log driver configuration in docker-compose:</p>
  <pre><code>logging:
      driver: splunk
      options:
          splunk-url: https://splunkhf:8088
          splunk-token: [TOKEN]
          splunk-index: splunk_index
          splunk-insecureskipverify: &quot;true&quot;
          splunk-sourcetype: log4j
          splunk-format: &quot;json&quot;
          tag: &quot;{{.Name}}/{{.ID}}&quot;
  </code></pre>
  <p>Example log message sent to splunk:</p>
  <pre><code>{
     line: 2021-01-12 11:37:49,191;10718;INFO ;[Thread-1];Logger; ;Executed all shutdown events. 
     source: stdout 
     tag: service_95f2bac29286/582385192fde 
  }
  </code></pre>
  <p>How can I configure Docker or Splunk to differentiate correctly between those different streams?`</p>