Docker Container

The Watchlog Agent can monitor log files from other containers using Docker volumes. Create a log-watchlist.json file in the same directory as your integration.json.

Step 1: Create log-watchlist.json

Create a file named log-watchlist.json:

[
  {
    "name": "app-logs",
    "path": "/shared-logs/app.log",
    "service": "application",
    "format": "auto"
  },
  {
    "name": "nginx-access",
    "path": "/shared-logs/nginx/access.log",
    "service": "nginx",
    "format": "auto"
  }
]

Step 2: Mount Shared Volumes

To access logs from other containers, you need to mount a shared volume. Here are two common approaches:

Method 1: Shared Docker Volume (Recommended)

Create a shared volume and mount it to both containers:

# Create a shared volume for logs
docker volume create shared-logs

# Run your application container with the shared volume
docker run -d \
  --name my-app \
  -v shared-logs:/app/logs \
  my-app-image

# Run watchlog-agent with the same shared volume
docker run -d \
  --name watchlog-agent \
  --network host \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -v /path/to/log-watchlist.json:/app/app/config/log-watchlist.json \
  -v shared-logs:/shared-logs \
  -e WATCHLOG_APIKEY="your_api_key" \
  -e WATCHLOG_SERVER="https://your.watchlog.server" \
  watchlog/agent:latest

In your log-watchlist.json, use paths relative to the mounted volume (e.g., /shared-logs/app.log).

Method 2: Bind Mount from Host

If your application writes logs to the host filesystem, you can bind mount them:

# Run your application container (logs written to host)
docker run -d \
  --name my-app \
  -v /var/log/my-app:/app/logs \
  my-app-image

# Run watchlog-agent with access to host logs
docker run -d \
  --name watchlog-agent \
  --network host \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -v /path/to/log-watchlist.json:/app/app/config/log-watchlist.json \
  -v /var/log/my-app:/host-logs \
  -e WATCHLOG_APIKEY="your_api_key" \
  -e WATCHLOG_SERVER="https://your.watchlog.server" \
  watchlog/agent:latest

In your log-watchlist.json, use paths relative to the mounted directory (e.g., /host-logs/app.log).

Log Format Options

"format": "auto" - Automatically detect log format (nginx, pm2, redis, mysql, docker, postgresql, mongodb)
"format": "custom" - Use a custom regex pattern:

{
  "name": "custom-logs",
  "path": "/shared-logs/custom.log",
  "service": "custom",
  "format": "custom",
  "pattern": "^(?<date>\\d{4}-\\d{2}-\\d{2}) \\[(?<level>\\w+)\\] (?<message>.*)$"
}

Backward Compatibility

You can still use the environment variable LOG_WATCHLIST_JSON if the file is not found:

-e LOG_WATCHLIST_JSON='[{"name":"app-logs","path":"/shared-logs/app.log","service":"application","format":"auto"}]'

Important Notes

The path in log-watchlist.json must be relative to the mount point in the container
If you use a shared volume, the path should be /shared-logs/...
If you use a bind mount, the path should be /host-logs/...
The log-watchlist.json file must be mounted in the same directory as integration.json