Docker container logs with OpenTelemetry

Collect logs from Docker and Docker Compose containers with the OpenTelemetry Collector, reading the files written by Docker’s default json-file logging driver. The same Collector can also forward traces and metrics from your apps — see Connect OpenTelemetry Collector to Bronto.

Prerequisites

A Bronto account and API key (how to create one)
Docker using the default json-file logging driver (logs at /var/lib/docker/containers/*/*-json.log)
An OpenTelemetry Collector (recommended) or Fluent Bit — run it as a container alongside your services

Run the Collector

Add the Collector to your docker-compose.yml and give it read access to Docker’s container log directory:

docker-compose.yml

services:
  otel-collector:
    image: otel/opentelemetry-collector-contrib:latest
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./otel-config.yaml:/etc/otel/config.yaml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro

The Collector tails the container logs, unwraps Docker’s JSON envelope, and ships to Bronto:

otel-config.yaml

receivers:
  filelog/docker:
    include:
      - /var/lib/docker/containers/*/*-json.log
    operators:
      - type: json_parser
    resource:
      service.name: <YOUR_DATASET_NAME>
      service.namespace: <YOUR_COLLECTION_NAME>

processors:
  batch:

exporters:
  otlphttp/brontologs:
    logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>

service:
  pipelines:
    logs:
      receivers: [filelog/docker]
      processors: [batch]
      exporters: [otlphttp/brontologs]

Set <REGION> to eu or us.

What you will see in Bronto

Open Search and filter by service.name. Docker’s json-file driver wraps each line as {"log": "...", "stream": "stdout|stderr", "time": "..."}; the json_parser operator promotes those into fields, so you get the container’s message, the stream, and a timestamp. Bronto’s Custom Parser extracts further structure from the message body.

Troubleshooting

No logs? Confirm the driver is json-file (docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container>) and that the Collector mounts /var/lib/docker/containers read-only.
Per-service datasets? Run one Collector centrally with a service.name per environment, or route by container labels with an attributes processor.
For general issues, see OTel Collector troubleshooting.

Alternative: Fluent Bit

If you already run Fluent Bit, tail the container log files and forward them over HTTP. The docker multiline parser reassembles partial lines from the json-file driver:

fluent-bit.conf

[INPUT]
    name              tail
    path              /var/lib/docker/containers/*/*-json.log
    multiline.parser  docker
    tag               docker

[OUTPUT]
    name        http
    match       docker
    host        ingestion.<REGION>.bronto.io
    port        443
    tls         on
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    <YOUR_DATASET_NAME>
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

Set Format to json_lines, not json. You can also point Docker’s native fluentd logging driver at Fluent Bit. See Connect Fluent Bit to Bronto for installation.

Overview

Ingest with agents

Ingest from AWS

Ingest from Azure

Ingest from CDN and edge

Ingest from apps and platforms

Ingest from infrastructure and databases

Ingest OpenTelemetry data

Docker container logs with OpenTelemetry

Prerequisites

Run the Collector

What you will see in Bronto

Troubleshooting

Alternative: Fluent Bit

​Prerequisites

​Run the Collector

​What you will see in Bronto

​Troubleshooting

​Alternative: Fluent Bit

Prerequisites

Run the Collector

What you will see in Bronto

Troubleshooting

Alternative: Fluent Bit