Send logs from Docker

Vector reads every container’s stdout and stderr through the Docker daemon socket and ships it to Rootprint over OTLP, with the container’s name, ID, and image attached. To tail specific files instead, see Vector, OpenTelemetry Collector, or Fluent Bit.

Prerequisites

A running Rootprint instance. Substitute its host for <your-rootprint>.
An ingest API key scoped to otel-logs-v0_9. Create one in Settings → API keys with Create ingest key, then substitute it for <your-ingest-api-key>. See API keys.
A Linux host with Docker and Docker Compose.

Mounting /var/run/docker.sock gives the Vector container full access to the Docker API. The :ro flag doesn’t restrict API calls.

Write the config

Save this as vector.yaml next to your docker-compose.yml. Replace <your-rootprint> and <your-ingest-api-key>.

Show vector.yaml

sources:
  docker:
    type: docker_logs
    exclude_containers:
      - rootprint-vector

transforms:
  to_otlp:
    type: remap
    inputs: [docker]
    source: |
      msg = to_string(.message) ?? ""
      lower = downcase(msg)
      sev_num = 9
      sev_text = "INFO"
      if match(lower, r'\berror\b|\bfatal\b|\bpanic\b|\bexception\b') {
        sev_num = 17
        sev_text = "ERROR"
      } else if match(lower, r'\bwarn(ing)?\b|\bdeprecated\b') {
        sev_num = 13
        sev_text = "WARN"
      }

      ts_nano = to_unix_timestamp(now(), unit: "nanoseconds")
      if exists(.timestamp) && is_timestamp(.timestamp) {
        ts_nano = to_unix_timestamp!(.timestamp, unit: "nanoseconds")
      }

      cname = string(.container_name) ?? ""
      cname = replace(cname, r'^/', "")
      svc_name = "unknown_service"
      if cname != "" { svc_name = cname }

      attrs = [
        { "key": "container.runtime", "value": { "stringValue": "docker" } }
      ]
      if exists(.container_id) { attrs = push(attrs, { "key": "container.id",         "value": { "stringValue": string!(.container_id) } }) }
      if cname != ""           { attrs = push(attrs, { "key": "container.name",       "value": { "stringValue": cname } }) }
      if exists(.image)        { attrs = push(attrs, { "key": "container.image.name", "value": { "stringValue": string!(.image) } }) }
      if exists(.image_id)     { attrs = push(attrs, { "key": "container.image.id",   "value": { "stringValue": string!(.image_id) } }) }
      if exists(.stream)       { attrs = push(attrs, { "key": "log.iostream",         "value": { "stringValue": string!(.stream) } }) }

      . = {
        "resourceLogs": [{
          "resource": {
            "attributes": [
              { "key": "service.name", "value": { "stringValue": svc_name } },
              { "key": "host.name",    "value": { "stringValue": get_hostname!() } }
            ]
          },
          "scopeLogs": [{
            "scope": { "name": "vector", "version": "" },
            "logRecords": [{
              "timeUnixNano":         ts_nano,
              "observedTimeUnixNano": to_unix_timestamp(now(), unit: "nanoseconds"),
              "severityNumber":       sev_num,
              "severityText":         sev_text,
              "body":                 { "stringValue": msg },
              "attributes":           attrs,
              "traceId":              "",
              "spanId":               "",
              "flags":                0,
              "droppedAttributesCount": 0
            }]
          }]
        }]
      }

sinks:
  rootprint:
    type: opentelemetry
    inputs: [to_otlp]
    protocol:
      type: http
      uri: https://<your-rootprint>/v1/logs
      method: post
      encoding:
        codec: otlp
      compression: gzip
      request:
        headers:
          Authorization: "Bearer <your-ingest-api-key>"
      batch:
        timeout_secs: 1
        max_bytes: 8388608

Add the Vector service to your compose file

Your application services need no changes.

services:
  rootprint-vector:
    image: timberio/vector:0.58.0-alpine
    container_name: rootprint-vector
    restart: unless-stopped
    volumes:
      - ./vector.yaml:/etc/vector/vector.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

Keep container_name and exclude_containers in vector.yaml identical. That’s how Vector skips its own logs.

Start Vector

docker compose up -d rootprint-vector

Send a test log line

docker run --rm --name rootprint-smoke-test alpine sh -c 'sleep 2; echo "hello from rootprint"; sleep 2'

The sleep calls give Vector time to attach before --rm removes the container.

Verify in Rootprint

Open Logs, pick otel-logs-v0_9 from the index selector, and search for hello from rootprint. Records typically appear within 5–10 seconds. service_name reads rootprint-smoke-test, and attributes.container.image.name reads alpine.

What you get in Rootprint

service_name is the container name without Docker’s leading /, or unknown_service when there is none.

Attribute	Value
`container.id`	full 64-character ID
`container.name`	name without the leading `/`
`container.image.name`	image reference (e.g., `nginx:latest`)
`container.image.id`	image digest
`container.runtime`	`docker`
`log.iostream`	`stdout` or `stderr`

The log level is inferred from the lowercased message:

error, fatal, panic, or exception (whole word) → ERROR
warn, warning, or deprecated → WARN
anything else → INFO

DEBUG is never inferred. If a container writes JSON to stdout, the body arrives as a JSON string. Add a parse_json call to the remap and push the parsed fields onto attrs. Container labels aren’t promoted by default. To promote one, add this to the remap before the . = { ... } assignment:

if exists(.label."com.example.team") {
  attrs = push(attrs, { "key": "team", "value": { "stringValue": string!(.label."com.example.team") } })
}

Troubleshooting

401/403/413/415: see Response codes.

Send logs with Vector: tail specific files on a host.
Send logs from Kubernetes: pod logs across a cluster.
OTLP reference: endpoint, response codes, limits.
Indexes: the otel-logs-v0_9 schema.

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Send logs from Docker

Prerequisites

What you get in Rootprint

Troubleshooting

​Prerequisites

​What you get in Rootprint

​Troubleshooting

​Related

Prerequisites

What you get in Rootprint

Troubleshooting

Related