Collecting Application Logs from Log File

Most steps are identical. To adapt this guide, update the endpoint and remove the ingestion key header as shown in Cloud → Self-Hosted.

Overview

This documentation provides instructions on configuring the OpenTelemetry Collector with the filelog receiver to read application logs from a file and export them to SigNoz.

The filelog receiver tails and parses logs from files, making it ideal for legacy applications or systems that write logs to disk rather than stdout/stderr.

Prerequisites

An instance of OpenTelemetry Collector running on your host
An instance of SigNoz (either Cloud or Self-Hosted)

Sample Log File

For this guide, you can create a sample log file named app.log at /tmp/app.log (or any accessible path) with the following content:

2026-01-12T10:00:00.000Z INFO [main] Application started successfully
2026-01-12T10:00:01.500Z INFO [auth] User 'alice' logged in from 192.168.1.10
2026-01-12T10:00:02.100Z WARN [db] Query execution took longer than 500ms
2026-01-12T10:00:03.200Z ERROR [payment] Payment gateway timeout for transaction #12345

The filelog receiver sends each line as a separate log entry. To parse structured fields like timestamp, level, and message, you can use SigNoz Logs Pipelines to parse logs after ingestion.

Configure Filelog Receiver

The following steps guide you through configuring the filelog receiver on different platforms.

A VM is a virtual computer that runs on physical hardware. This includes:

Cloud VMs: AWS EC2, Google Compute Engine, Azure VMs, DigitalOcean Droplets
On-premise VMs: VMware, VirtualBox, Hyper-V, KVM
Bare metal servers: Physical servers running Linux/Unix directly

Use this section if you're deploying your application directly on a server or VM without containerization.

1. Install OpenTelemetry Collector

Follow this guide to install the OpenTelemetry Collector as an agent on your Virtual Machine.

2. Edit Configuration File

Locate your OpenTelemetry Collector configuration file (typically config.yaml or /etc/otel-collector/config.yaml).

Add the filelog receiver to the receivers section:

receivers:
  filelog/app:
    include: [/tmp/app.log] # Replace with your actual log file path
    start_at: end

start_at: The start_at: end configuration ensures that only newly added logs are transmitted. To include historical logs from the file, change this to start_at: beginning.

The /app suffix in filelog/app is a custom identifier that allows you to configure multiple filelog receivers with different settings. You can name differently for different apps (e.g., filelog/nginx, filelog/application).

3. Enable in Pipeline

Add the filelog receiver to your logs pipeline in the service section of your configuration.

service:
  pipelines:
    logs:
      receivers: [otlp, filelog/app] # Add filelog/app here
      processors: [batch]
      exporters: [otlp]

4. Restart Collector

Restart the OpenTelemetry Collector service for changes to take effect.

sudo systemctl restart otel-collector

If you are running the OpenTelemetry Collector as a Docker container, you need to mount the log file from your host machine into the container.

1. Edit Configuration File

Add the filelog receiver to the receivers section of your otel-collector-config.yaml:

receivers:
  filelog:
    include: [/tmp/app.log] # Path inside the container
    start_at: end

2. Enable in Pipeline

Add the filelog receiver to your logs pipeline in the service section:

service:
  pipelines:
    logs:
      receivers: [otlp, filelog] # Add filelog here
      processors: [batch]
      exporters: [otlp]

3. Run Collector with Mounts

Run the collector container, mounting your host log file (e.g., ~/logs/app.log) to the expected path inside the container (e.g., /tmp/app.log).

docker run -d \
  --name signoz-otel-collector \
  -v ~/logs/app.log:/tmp/app.log:ro \
  -v $(pwd)/otel-collector-config.yaml:/etc/otel/config.yaml \
  otel/opentelemetry-collector-contrib:latest \
  --config /etc/otel/config.yaml

For production deployments, pin to a specific version tag instead of latest to ensure consistency. Check the releases page for available versions.

For more examples, see the Collect Docker Logs doc.

1. Install OpenTelemetry Collector

Follow this guide to install the OpenTelemetry Collector on Windows.

2. Edit Configuration File

Locate your OpenTelemetry Collector configuration file (e.g., C:\ProgramData\OpenTelemetry Collector\config.yaml).

Add the filelog receiver to the receivers section, ensuring you use valid Windows paths (escape backslashes):

receivers:
  filelog/app:
    include: ["C:/Logs/app.log"]
    start_at: end

3. Enable in Pipeline

Add the filelog receiver to your logs pipeline:

service:
  pipelines:
    logs:
      receivers: [otlp, filelog/app]
      processors: [batch]
      exporters: [otlp]

4. Restart Service

Restart the OpenTelemetry Collector service via PowerShell:

Restart-Service opentelemetry-collector

Tagging Logs from Multiple Applications

When several named filelog receivers (such as filelog/app above) feed the same collector, tag each one so you can tell which application a log came from.

Automatic file-based tags

include_file_name defaults to true, so every log already carries a log.file.name attribute. Set include_file_path: true to also capture the full path as log.file.path. If each application writes to its own file, this alone is enough to separate them, no extra config needed.

Custom tags per application

To tag logs with your own identifier instead, such as service.name, add a resource or attributes map directly under each named receiver:

receivers:
  filelog/nginx:
    include: [/var/log/nginx/access.log]
    start_at: end
    resource:
      service.name: nginx
  filelog/payments:
    include: [/var/log/payments/app.log]
    start_at: end
    resource:
      service.name: payments

Add both receivers to the logs pipeline as usual:

service:
  pipelines:
    logs:
      receivers: [otlp, filelog/nginx, filelog/payments]
      processors: [batch]
      exporters: [otlp]

resource sets resource-level attributes, filterable the same way as service.name on any other signal. attributes sets log-record-level attributes instead. Both fields are documented in the filelog receiver README.

For tags that should apply to every log from this collector rather than one application, such as deployment.environment, use the resource processor instead.

On Kubernetes, pods and containers already get k8s.pod.name, k8s.container.name, and k8s.namespace.name attached automatically, so no manual tagging is needed to separate applications there.

Once tagged, use Logs Pipelines to parse or rename these attributes, for example turning log.file.name into a friendlier field, directly from the SigNoz UI.

Validate Logs

Once configured and restarted, generate some new logs in your file:

echo "Testing SigNoz filelog receiver $(date)" >> /tmp/app.log
echo "2026-01-12T12:00:00.000Z INFO [test] Manual log entry for verification" >> /tmp/app.log
echo "2026-01-12T12:00:01.500Z INFO [test] Manual log entry for verification" >> /tmp/app.log
echo "2026-01-12T12:00:02.100Z INFO [test] Manual log entry for verification" >> /tmp/app.log
echo "2026-01-12T12:00:03.200Z INFO [test] Manual log entry for verification" >> /tmp/app.log

For Windows, use PowerShell:

Add-Content -Path "C:\Logs\app.log" -Value "Testing SigNoz filelog receiver $(Get-Date)"
Add-Content -Path "C:\Logs\app.log" -Value "2026-01-12T12:00:00.000Z INFO [test] Manual log entry for verification"

Go to the SigNoz UI -> Logs tab. You should see your new log entries appearing.

Logs of the dummy app.log file visible in SigNoz — *Sample log file data shown in SigNoz Logs Explorer*

Troubleshooting

Logs not appearing in SigNoz

Check File Permissions: Ensure the OpenTelemetry Collector user has read permissions for the log file. On Linux, the collector usually runs as otel or root.
```
ls -l /tmp/app.log
# Adjust permissions if necessary
chmod 644 /tmp/app.log
```
Verify Path: Double-check the path in the include config. For glob patterns (e.g. *.log), ensure it matches the actual files.
Check start_at Setting: If you set start_at: end (default), the collector only reads new lines written after the collector starts. To see existing lines, change to start_at: beginning and restart the collector.
Check Collector Logs: Look at the OTel Collector's own logs for errors (e.g. "permission denied", "no files found").
```
# For systemd
journalctl -u otel-collector -f
# For Docker
docker logs signoz-otel-collector
```

Advanced Configuration

For production use, especially when using start_at: beginning, configure a storage extension to prevent log duplication on collector restarts. The storage extension saves the read position for each file to disk.

extensions:
  file_storage:
    directory: /var/lib/otelcol/file_storage
 
receivers:
  filelog:
    include: [/tmp/app.log]
    start_at: beginning
    storage: file_storage # Reference the storage extension
 
service:
  extensions: [file_storage]
  pipelines:
    logs:
      receivers: [filelog]
      processors: [batch]
      exporters: [otlp]

Without a storage extension, using start_at: beginning will cause the collector to re-read all files from the beginning after each restart, potentially creating duplicate logs in SigNoz.

Next Steps

Querying Logs: Learn how to filter and query your logs.
Create Alerts: Set up alerts based on log content.

Get Help

If you need help with the steps in this topic, please reach out to us on SigNoz Community Slack. If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at cloud-support@signoz.io.

Collecting Application Logs from Log File

Overview

Prerequisites

Sample Log File

Configure Filelog Receiver

1. Install OpenTelemetry Collector

2. Edit Configuration File

3. Enable in Pipeline

4. Restart Collector

1. Edit Configuration File

2. Enable in Pipeline

3. Run Collector with Mounts

1. Install OpenTelemetry Collector

2. Edit Configuration File

3. Enable in Pipeline

4. Restart Service

Tagging Logs from Multiple Applications

Automatic file-based tags

Custom tags per application

Validate Logs

Troubleshooting

Logs not appearing in SigNoz

Advanced Configuration

Next Steps

Get Help

Was this page helpful?

Is this page helpful?