victoria-logs + vector + docker

compose.yml

services:
  victorialogs:
    image: victoriametrics/victoria-logs:v1.15.0-victorialogs
    command:
      - "--storageDataPath=/victoria-logs-data"
      - "--httpListenAddr=:9428"
      - "--retentionPeriod=5d"
      - "--retention.maxDiskSpaceUsageBytes=2Gib"
    volumes:
      - victorialogs-data:/victoria-logs-data
    ports:
      - 127.0.0.1:9428:9428
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.vlog.entrypoints=http"
      - "traefik.http.routers.vlog.rule=Host(`vlog.example.com`)"
      - "traefik.http.services.vlog.loadbalancer.server.port=9428"

  vector:
    image: timberio/vector:latest-distroless-libc
    container_name: vector
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
      - type: bind
        source: /var/lib/docker
        target: /var/lib/docker
      - ./vector.yml:/etc/vector/vector.yaml:ro
#      - ./laravel.log:/var/log/app/laravel.log
    ports:
      - 127.0.0.1:8686:8686
    user: root
    restart: unless-stopped
    networks:
      - web

#  promtail:
#    image: grafana/promtail:3.2.1
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock:ro
#      - /var/lib/docker/containers:/var/lib/docker/containers:ro
#      - ./promtail-config.yml:/mnt/config/promtail-config.yaml
#    command: -config.file=/mnt/config/promtail-config.yaml
#    networks:
#      - web

networks:
  web:
    external: true

volumes:
  victorialogs-data:

promtail-config.yml

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: "http://victorialogs:9428/insert/loki/api/v1/push"

scrape_configs:
#  - job_name: system
#    static_configs:
#      - targets:
#          - localhost
#        labels:
#          job: varlogs
#          __path__: /var/log/*log

#  - job_name: docker
#    static_configs:
#      - targets:
#          - localhost
#        labels:
#          job: docker_logs
#          __path__: /var/lib/docker/containers/*/*-json.log

  - job_name: container
    docker_sd_configs:
    - host: unix:///var/run/docker.sock
      refresh_interval: 10s
    relabel_configs:
    - source_labels: ['__meta_docker_container_name']
      regex: '/(.*)'
      target_label: 'container'
    - source_labels: ['__meta_docker_container_log_stream']
      target_label: 'logstream'
    - source_labels: ['__meta_docker_container_label_logging_jobname']
      target_label: 'job'

vector.yml

api:
  enabled: true
  address: 0.0.0.0:8686

sources:
  docker:
    type: docker_logs
  vector_metrics:
    type: internal_metrics
#  app_logs:
#    type: "file"
#    include:
#      - "/var/log/app/laravel.log"

transforms:
  msg_parser:
    type: remap
    inputs: [docker]
    source: |
      .message = parse_json(.message) ?? .message

sinks:
  elasticsearch:
    type: elasticsearch
    inputs: [msg_parser]
    endpoints: [http://victorialogs:9428/insert/elasticsearch/]
    mode: bulk
    api_version: v8
    compression: gzip
    healthcheck:
      enabled: false
    request:
      headers:
        VL-Stream-Fields: source_type,label.com.docker.compose.service
        VL-Time-Field: timestamp
        VL-Msg-Field: message,log
        AccountID: "0"
        ProjectID: "0"

#  victoriametrics:
#    type: prometheus_remote_write
#    endpoint: http://victoriametrics:8428/api/v1/write
#    inputs: [vector_metrics]
#    healthcheck:
#      enabled: false