Docker Container

Create an integration.json file and mount it as a volume:

[
  {
    "service": "redis",
    "monitor": true,
    "host": "127.0.0.1",
    "port": "6379",
    "username": "",
    "password": "your_password"
  },
  {
    "service": "redis",
    "monitor": true,
    "host": "127.0.0.1",
    "port": "6380",
    "username": "",
    "password": "your_password"
  }
]

Then run the container:

docker run -d \
  --name watchlog-agent \
  --network host \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -e WATCHLOG_APIKEY="YOUR_APIKEY" \
  -e WATCHLOG_SERVER="https://log.watchlog.io" \
  watchlog/agent:latest

redis-cli ships inside the agent image at a version new enough for --json, so nothing extra is needed.

Reaching Redis from the container

Redis runs…	Use
On the same host, agent on `--network host`	`127.0.0.1`
On the same host, agent on a bridge network	`host.docker.internal` (Docker Desktop) or the host's LAN IP
In another container on a shared user-defined network	The container or service name, e.g. `redis`
On a remote host	Its hostname or IP

protected-mode

Redis refuses connections from outside localhost when protected-mode is on and no password is set. From Redis's perspective the agent connects from the Docker bridge address, so a password-less Redis will reject it. Set a password — which you want anyway — rather than disabling protected mode.

If the agent and Redis share a Docker network:

docker run -d \
  --name watchlog-agent \
  --network app-net \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -e WATCHLOG_APIKEY="YOUR_APIKEY" \
  -e WATCHLOG_SERVER="https://log.watchlog.io" \
  watchlog/agent:latest

{
  "service": "redis",
  "monitor": true,
  "host": "redis",
  "port": "6379",
  "password": "your_password"
}

Creating an ACL user (Redis 6+)

docker exec -i redis redis-cli ACL SETUSER watchlog_monitor on '>your_password' '~*' '&*' \
  +@read +info +config\|get +slowlog\|get +client\|list +cluster\|info +cluster\|nodes

docker exec -i redis redis-cli ACL SAVE

Tips

docker exec needs -i to attach stdin. Without it a heredoc is a silent no-op.

Then set both username and password in the config. On Redis 5 there are no ACL usernames — leave username empty and use password alone.

Docker Compose

services:
  watchlog-agent:
    image: watchlog/agent:latest
    container_name: watchlog-agent
    restart: unless-stopped
    environment:
      WATCHLOG_APIKEY: "YOUR_APIKEY"
      WATCHLOG_SERVER: "https://log.watchlog.io"
    volumes:
      - ./integration.json:/app/app/config/integration.json:ro
    networks:
      - app-net

networks:
  app-net:
    external: true

Memory limit in containers

A containerised Redis with no maxmemory will happily grow until the container's cgroup limit kills it — and Watchlog cannot warn you about a limit that does not exist, so it reports usage without a percentage instead of inventing one.

docker exec -i redis redis-cli CONFIG GET maxmemory

Setting maxmemory to somewhat below the container limit, with a maxmemory-policy, is what makes the memory-pressure part of the health score meaningful.

Multiple Redis Instances

You can monitor multiple Redis instances by adding multiple entries with the same service name. Each instance is automatically identified by its host:port combination.

Monitoring both sides of a replication pair is worth doing: a replica reports its own master link status and offset lag, which the primary cannot tell you.