Docker (system) events are only available through the Docker Engine API, e.g. with the Docker client docker events
or docker system events
commands.
Sadly, few log forwarders have a facility to collect these events.
Most log forwarders can natively collect containers' logs. Let's create a container that spits Docker events to stdout.
docker run --volume /var/run/docker.sock:/var/run/docker.sock docker events --format '{{json .}}'