Promtail — Log Agent

Promtail

Agent that reads Docker container logs and pushes to Loki.

How It Works

1. Connects to Docker socket

2. Auto-discovers all containers

3. Reads stdout/stderr via Docker API

4. Adds labels: container, service

5. Pushes to Loki via HTTP

Exclude Containers

Promtail doesn't support exclude_containers. Use relabel:

relabel_configs:
  - source_labels: ['__meta_docker_container_name']
    regex: '/(loki|promtail|grafana|vector|clickhouse|prometheus|node-exporter|cadvisor)'
    action: drop

Multi-Server

On remote server, point Promtail to central Loki:

clients:
  - url: http://10.0.0.1:3100/loki/api/v1/push

Use WireGuard for security.