Docker container logs and metrics with OpenTelemetry

Collect container logs and runtime metrics from Docker and Docker Compose with the OpenTelemetry Collector and forward them to Bronto.

Collect logs and runtime metrics from Docker and Docker Compose with the OpenTelemetry Collector. The filelog receiver reads Docker’s json-file logs, while docker_stats reads CPU, memory, network, block-I/O, and container-status metrics from the Docker API.

Prerequisites

• A Bronto account and API key (how to create one)
• Docker using the default json-file logging driver (logs at /var/lib/docker/containers/*/*-json.log)
• An OpenTelemetry Collector (recommended) or Fluent Bit — run it as a container alongside your services

Run the Collector

Add the Collector to your docker-compose.yml and give it read access to Docker’s container log directory and API socket:

docker-compose.yml

services:
  otel-collector:
    image: otel/opentelemetry-collector-contrib:latest
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./otel-config.yaml:/etc/otel/config.yaml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

The Collector tails the container logs, unwraps Docker’s JSON envelope, and ships to Bronto:

otel-config.yaml

receivers:
  filelog/docker:
    include:
      - /var/lib/docker/containers/*/*-json.log
    operators:
      - type: json_parser
    resource:
      service.name: <YOUR_DATASET_NAME>
      service.namespace: <YOUR_COLLECTION_NAME>
  docker_stats:
    endpoint: unix:///var/run/docker.sock
    collection_interval: 30s

processors:
  batch:

exporters:
  otlphttp/brontologs:
    logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>
  otlphttp/brontometrics:
    metrics_endpoint: "https://ingestion.<REGION>.bronto.io/v1/metrics"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>

service:
  pipelines:
    logs:
      receivers: [filelog/docker]
      processors: [batch]
      exporters: [otlphttp/brontologs]
    metrics:
      receivers: [docker_stats]
      processors: [batch]
      exporters: [otlphttp/brontometrics]

Set <REGION> to eu or us.

For receiver options and the full measurement list, see the Collector Contrib Docker Stats receiver.

What you will see in Bronto

Logs appear in Search. Docker’s json-file driver wraps each line as {"log": "...", "stream": "stdout|stderr", "time": "..."}; the json_parser operator promotes those into fields. Runtime measurements appear in the Metric Explorer.

Exponential histograms are not supported, and the Metric Explorer does not currently provide a Rate function.

This covers container logs and runtime metrics. To add distributed traces and per-route RED metrics for the applications in those containers, without changing them, see Zero-code instrumentation with eBPF.

Troubleshooting

• No logs? Confirm the driver is json-file (docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container>) and that the Collector mounts /var/lib/docker/containers read-only.
• No metrics? Confirm the Collector mounts /var/run/docker.sock and its user can read the socket.
• Per-service datasets? Run one Collector centrally with a service.name per environment, or route by container labels with an attributes processor.
• For general issues, see OTel Collector troubleshooting.

Alternative: Fluent Bit

If you already run Fluent Bit, tail the container log files and forward them over HTTP. The docker multiline parser reassembles partial lines from the json-file driver:

fluent-bit.conf

[INPUT]
    name              tail
    path              /var/lib/docker/containers/*/*-json.log
    multiline.parser  docker
    tag               docker

[OUTPUT]
    name        http
    match       docker
    host        ingestion.<REGION>.bronto.io
    port        443
    tls         on
    format      json_lines
    compress    gzip
    header      x-bronto-api-key    <YOUR_API_KEY>
    header      x-bronto-dataset    <YOUR_DATASET_NAME>
    header      x-bronto-collection <YOUR_COLLECTION_NAME>

Set Format to json_lines, not json. You can also point Docker’s native fluentd logging driver at Fluent Bit. See Connect Fluent Bit to Bronto for installation.