Send Caddy logs

This page ships Caddy’s JSON logs to Rootprint over OTLP with the OpenTelemetry Collector or Vector. Records land in otel-logs-v0_9 with service.name: caddy, and access-log fields arrive as OpenTelemetry HTTP attributes.

Prerequisites

A running Rootprint instance. Substitute its host for <your-rootprint>.
An ingest API key scoped to otel-logs-v0_9. Create one in Settings → API keys with Create ingest key, then substitute it for <your-ingest-api-key>. See API keys.
A host running Caddy.
The OpenTelemetry Collector or Vector installed on the Caddy host. The agent pages cover installation.

Enable Caddy file logging

Caddy’s systemd service logs to journald by default. Add these blocks to /etc/caddy/Caddyfile so Caddy writes JSON to files. Add a log block to every site whose access log you want to ship. Keep Caddy’s default JSON encoder: don’t add a format directive. mode 0640 lets the caddy group read the log files. It needs Caddy 2.9 or later.

# Global block — Caddy runtime errors
{
    log default {
        output file /var/log/caddy/error.log {
            mode 0640
        }
    }
}

# Per-site — JSON access log
example.com {
    log {
        output file /var/log/caddy/access.log {
            mode 0640
        }
    }
    # ... rest of the site config
}

sudo systemctl reload caddy

Write the agent config

Replace <your-rootprint> and <your-ingest-api-key>.

OpenTelemetry Collector
Vector

Save this as /etc/otelcol-contrib/config.yaml.

Show config.yaml

receivers:
  file_log:
    include:
      - /var/log/caddy/access.log
      - /var/log/caddy/error.log
    start_at: end
    operators:
      - type: json_parser
        parse_to: body
        timestamp:
          parse_from: body.ts
          layout_type: epoch
          layout: s.us
        severity:
          parse_from: body.level
          overwrite_text: true
          mapping:
            debug: debug
            info: info
            warn: warn
            error: error
            fatal:
              - panic
              - fatal

processors:
  resource:
    attributes:
      - key: service.name
        value: caddy
        action: upsert
  transform:
    log_statements:
      - context: log
        statements:
          - set(attributes["caddy.logger"], body["logger"]) where body["logger"] != nil
          - set(attributes["http.request.method"], body["request"]["method"]) where body["request"]["method"] != nil
          - set(attributes["url.path"], body["request"]["uri"]) where body["request"]["uri"] != nil
          - set(attributes["server.address"], body["request"]["host"]) where body["request"]["host"] != nil
          - set(attributes["client.address"], body["request"]["remote_ip"]) where body["request"]["remote_ip"] != nil
          - set(attributes["http.response.status_code"], Int(body["status"])) where body["status"] != nil
          - set(attributes["http.response.body.size"], Int(body["size"])) where body["size"] != nil
          - set(attributes["client.port"], Int(body["request"]["remote_port"])) where body["request"]["remote_port"] != nil
          - set(attributes["network.protocol.name"], ConvertCase(Split(body["request"]["proto"], "/")[0], "lower")) where body["request"]["proto"] != nil
          - set(attributes["network.protocol.version"], Split(body["request"]["proto"], "/")[1]) where body["request"]["proto"] != nil
          - set(attributes["user_agent.original"], body["request"]["headers"]["User-Agent"][0]) where body["request"]["headers"]["User-Agent"] != nil
          - set(body, body["msg"]) where body["msg"] != nil
  batch: {}

exporters:
  otlp_http:
    logs_endpoint: https://<your-rootprint>/v1/logs
    compression: gzip
    headers:
      Authorization: "Bearer <your-ingest-api-key>"

service:
  pipelines:
    logs:
      receivers: [file_log]
      processors: [resource, transform, batch]
      exporters: [otlp_http]

Save this as /etc/vector/vector.yaml.

Show vector.yaml

sources:
  caddy_logs:
    type: file
    include:
      - /var/log/caddy/access.log
      - /var/log/caddy/error.log
    read_from: end

transforms:
  parse_caddy:
    type: remap
    inputs: [caddy_logs]
    source: |
      parsed, err = parse_json(.message)
      if err == null && is_object(parsed) {
        . = merge(., object!(parsed))
      }

      levels = {
        "debug": [5, "DEBUG"],
        "info": [9, "INFO"],
        "warn": [13, "WARN"],
        "error": [17, "ERROR"],
        "panic": [21, "FATAL"],
        "fatal": [21, "FATAL"]
      }
      level = get(levels, [downcase(string(.level) ?? "info")]) ?? [9, "INFO"]
      .severity_number = level[0]
      .severity_text = level[1]

  to_otlp:
    type: remap
    inputs: [parse_caddy]
    source: |
      msg       = string(.msg) ?? string(.message) ?? ""
      file_path = string(.file) ?? ""

      ts_nano = to_unix_timestamp(now(), unit: "nanoseconds")
      ts_float, ts_err = to_float(.ts)
      if ts_err == null {
        ts_nano = to_int(ts_float * 1000000000.0)
      }

      sev_num  = to_int(.severity_number) ?? 9
      sev_text = string(.severity_text)   ?? "INFO"

      attrs = [
        { "key": "log.file.path", "value": { "stringValue": file_path } }
      ]
      if exists(.logger) {
        attrs = push(attrs, { "key": "caddy.logger", "value": { "stringValue": string!(.logger) } })
      }

      if exists(.request) {
        if exists(.request.method) {
          attrs = push(attrs, { "key": "http.request.method", "value": { "stringValue": string!(.request.method) } })
        }
        if exists(.request.uri) {
          attrs = push(attrs, { "key": "url.path", "value": { "stringValue": string!(.request.uri) } })
        }
        if exists(.request.host) {
          attrs = push(attrs, { "key": "server.address", "value": { "stringValue": string!(.request.host) } })
        }
        if exists(.request.remote_ip) {
          attrs = push(attrs, { "key": "client.address", "value": { "stringValue": string!(.request.remote_ip) } })
        }
        if exists(.request.remote_port) {
          port_int, port_err = to_int(.request.remote_port)
          if port_err == null {
            attrs = push(attrs, { "key": "client.port", "value": { "intValue": port_int } })
          }
        }
        if exists(.request.proto) {
          parts = split(string!(.request.proto), "/")
          if length(parts) == 2 {
            proto_name = downcase(string!(parts[0]))
            proto_version = string!(parts[1])
            attrs = push(attrs, { "key": "network.protocol.name",    "value": { "stringValue": proto_name } })
            attrs = push(attrs, { "key": "network.protocol.version", "value": { "stringValue": proto_version } })
          }
        }
        ua = .request.headers."User-Agent"
        if is_array(ua) && length!(ua) > 0 {
          attrs = push(attrs, { "key": "user_agent.original", "value": { "stringValue": string!(ua[0]) } })
        }
        if exists(.status) {
          status_int, status_err = to_int(.status)
          if status_err == null {
            attrs = push(attrs, { "key": "http.response.status_code", "value": { "intValue": status_int } })
          }
        }
        if exists(.size) {
          size_int, size_err = to_int(.size)
          if size_err == null {
            attrs = push(attrs, { "key": "http.response.body.size", "value": { "intValue": size_int } })
          }
        }
      }

      . = {
        "resourceLogs": [{
          "resource": {
            "attributes": [
              { "key": "service.name", "value": { "stringValue": "caddy" } },
              { "key": "host.name",    "value": { "stringValue": get_hostname!() } }
            ]
          },
          "scopeLogs": [{
            "scope": { "name": "vector", "version": "" },
            "logRecords": [{
              "timeUnixNano":         ts_nano,
              "observedTimeUnixNano": to_unix_timestamp(now(), unit: "nanoseconds"),
              "severityNumber":       sev_num,
              "severityText":         sev_text,
              "body":                 { "stringValue": msg },
              "attributes":           attrs,
              "traceId":              "",
              "spanId":               "",
              "flags":                0,
              "droppedAttributesCount": 0
            }]
          }]
        }]
      }

sinks:
  rootprint:
    type: opentelemetry
    inputs: [to_otlp]
    protocol:
      type: http
      uri: https://<your-rootprint>/v1/logs
      method: post
      encoding:
        codec: otlp
      compression: gzip
      request:
        headers:
          Authorization: "Bearer <your-ingest-api-key>"
      batch:
        timeout_secs: 1
        max_bytes: 8388608

The Collector config (start_at: end) reads only lines written after each start, so it skips lines written while it was stopped. Vector (read_from: end) skips existing lines on first start only, then resumes from its checkpoint.

Grant read access to /var/log/caddy

Let the caddy group enter the log directory, and add your agent’s user to that group:

sudo chmod 750 /var/log/caddy
sudo usermod -aG caddy otelcol-contrib   # Vector: sudo usermod -aG caddy vector

Restart the agent

Run sudo systemctl restart otelcol-contrib or sudo systemctl restart vector. The agent’s log should show no config or exporter errors.

Send a test request

Hit a site that has a log block:

curl -i http://localhost/

Verify in Rootprint

Open Logs, pick otel-logs-v0_9 from the index selector, and search for service_name:caddy. Records typically appear within 5–10 seconds.

What you get in Rootprint

Both agents produce the same attributes. Entries without a request object, such as Caddy’s runtime logs, carry only caddy.logger and log.file.path.

OTLP key	Source field
`http.request.method`	`.request.method`
`url.path`	`.request.uri`
`server.address`	`.request.host`
`client.address`	`.request.remote_ip`
`client.port`	`.request.remote_port` (integer)
`network.protocol.name`	first half of `.request.proto` split on `/`
`network.protocol.version`	second half of `.request.proto`
`user_agent.original`	first element of `.request.headers."User-Agent"`
`http.response.status_code`	`.status`
`http.response.body.size`	`.size`
`caddy.logger`	`.logger` (e.g., `http.log.access.log0`, `http.log.error`)
`log.file.path`	source file path (Vector only)

Log level: taken from Caddy’s level field. Caddy logs 5xx responses at error, and panic and fatal map to FATAL.
Timestamp: taken from Caddy’s ts field, with the agent’s read time as a fallback.

Useful searches

Find	Query
5xx responses	`service_name:caddy AND attributes.http.response.status_code:>=500`
4xx and 5xx under one path	`service_name:caddy AND attributes.url.path:/api/* AND attributes.http.response.status_code:>=400`
One client IP	`attributes.client.address:1.2.3.4`
Access-log entries only	`service_name:caddy AND attributes.caddy.logger:http.log.access*`

Troubleshooting

body is raw JSON and entries have no http.* attributes: the Caddyfile sets a format directive. The parsers expect Caddy’s default JSON encoder. Remove the format directive or extend the parser.
401/403/413/415: see Response codes.

Send logs with the OpenTelemetry Collector and Send logs with Vector: install and run the agents.
Send Nginx logs: the same setup for nginx.
OTLP reference: endpoint, response codes, limits.
Indexes: the otel-logs-v0_9 schema.

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Prerequisites

What you get in Rootprint

Useful searches

Troubleshooting

​Prerequisites

​What you get in Rootprint

​Useful searches

​Troubleshooting

​Related

Prerequisites

What you get in Rootprint

Useful searches

Troubleshooting

Related