We use <a href="https:&#x2F;&#x2F;github.com&#x2F;gliderlabs&#x2F;logspout" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gliderlabs&#x2F;logspout</a> streaming to elastic search but this does have a few seconds of latency.<p>Somewhat off topic but you aren&#x27;t worried about using docker to sandbox user scripting?  Especially being a security company.