Briven/infra/observability/promtail/config.yaml

# Promtail — file-based docker log discovery.
#
# Per DOCKER.md §1 we DO NOT touch the Docker daemon for log discovery
# or tailing. No docker_sd_configs, no docker.sock mount. Instead we
# read the json-file driver's output directly from
# /var/lib/docker/containers/*/*-json.log — same data, zero daemon load.
#
# Filtering to "only briven containers" can't be done off the container
# label (that would require asking the daemon). Instead we filter by
# the JSON `service` label that briven services emit on every log line
# via @briven/shared/observability. Non-briven containers don't produce
# that JSON shape, so their lines flow through with `service` absent and
# Loki queries naturally exclude them via the standard
# `{service=~"api|runtime|realtime|web|docs"}` selector.

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://briven-loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: docker-files
    # Static targets + __path__ glob is the Promtail idiom for file-based
    # discovery. No daemon involvement; Promtail tails the json files
    # directly via inotify on the host bind-mount.
    static_configs:
      - targets:
          - localhost
        labels:
          job: docker
          __path__: /var/lib/docker/containers/*/*-json.log
    pipeline_stages:
      # Each line in *-json.log is wrapped by the docker json-file
      # driver as: {"log":"<raw stdout line>\n","stream":"stdout","time":"..."}.
      # First parse unwraps the docker envelope.
      - json:
          expressions:
            output: log
            stream: stream
            time: time
      - timestamp:
          source: time
          format: RFC3339Nano
      - output:
          source: output
      - labels:
          stream:
      # Extract the container id from the file path so an operator can
      # at least correlate a line back to a specific container without
      # asking the daemon.
      - regex:
          source: filename
          expression: '/var/lib/docker/containers/(?P<container_id>[a-f0-9]{12})'
      - labels:
          container_id:
      # Now the wrapped `output` field holds the application's raw stdout.
      # For briven services that's our @briven/shared/observability JSON
      # shape; parse it to lift level/msg/service/env into labels.
      - json:
          expressions:
            level: level
            msg: msg
            service: service
            env: env
      - labels:
          level:
          service:
          env: