Collecting Docker Container Logs

You can easily collect all your Docker container logs using OpenTelemetry Collector and perform advanced queries to analyze them efficiently using SigNoz.

Prerequisites

Docker Engine 20.10+ installed and running
Administrative access to the Docker host

Setup

Step 1: Install OpenTelemetry Collector

Install the OpenTelemetry Collector by following this document. If you have already installed the OpenTelemetry Collector, skip this step.

Step 2: Update Collector Configuration

Add the filelog receiver to your existing config.yaml file to collect Docker container logs:

config.yaml

receivers:  
  # Add this receiver for Docker logs
  filelog:
    include: [/var/lib/docker/containers/*/*-json.log]
    poll_interval: 200ms
    start_at: end
    include_file_name: false
    include_file_path: false
    operators:
      - id: container-parser
        type: container
        format: docker
        add_metadata_from_filepath: false
      - id: extract-service-name
        type: regex_parser
        parse_from: body
        regex: 'service.name":\s*"(?P<svc>[^"]+)"'
      - id: set-service-name
        type: move
        from: attributes.svc
        to: resource["service.name"]
        if: 'attributes.svc != nil'

service:
  pipelines:
    # Add receiver to logs pipeline
    logs:
      receivers: [otlp, filelog]
      processors: [batch]
      exporters: [otlp]

These operators extract service.name from JSON-formatted log bodies and move it to the resource level. This is useful when your application emits structured JSON logs with an explicit service.name field. If the field is missing, these operators are safely skipped.

📝 Note

If your logs originate from Kubernetes pod log file paths (for example, /var/log/pods/... or /var/log/containers/...) instead of Docker container log files on the host, set add_metadata_from_filepath: true in the container parser operator. This enables automatic extraction of Kubernetes metadata such as pod name, namespace, and container name from the log file path.

Step 3: Update Docker Run Command

Restart the OpenTelemetry Collector with additional volume mounts to access Docker logs:

Stop existing collector

docker stop opentelemetry-collector
docker rm opentelemetry-collector

Run with Docker logs access

docker run --name opentelemetry-collector \
  --restart unless-stopped \
  --detach \
  --user 0:0 \
  --pid host \
  --network host \
  -v /var/lib/docker/containers:/var/lib/docker/containers:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /proc:/hostfs/proc:ro \
  -v /sys:/hostfs/sys:ro \
  -v /:/hostfs:ro \
  -v "$(pwd)/config.yaml":/etc/otelcol-contrib/config.yaml \
  -e HOST_PROC=/hostfs/proc \
  -e HOST_SYS=/hostfs/sys \
  -e HOST_ROOT=/hostfs \
  otel/opentelemetry-collector-contrib:0.130.1

Step 4: Verify Log Collection

Check that the collector is processing Docker logs:

Check collector logs

docker logs opentelemetry-collector

Generate test logs

docker run --rm alpine sh -c 'for i in $(seq 1 10); do echo "Test log entry $i"; sleep 1; done'

View Logs in SigNoz

The Docker container logs will be visible in the Logs tab of SigNoz.

Docker container logs visible in SigNoz — *Docker test logs visible in SigNoz*

Troubleshooting

No Logs Appearing

Check file permissions:
```
ls -la /var/lib/docker/containers/
```

Verify collector has access:

docker run --rm \
  -v /var/lib/docker/containers:/var/lib/docker/containers:ro \
  alpine ls /var/lib/docker/containers/

Check collector logs for errors:

docker logs opentelemetry-collector | grep -i error