Docker Compose Logging: Centralized Logs with Loki and Grafana

Why Centralized Logging?

Running docker logs on each container doesn't scale. Centralized logging lets you search all your homelab logs in one place, set up alerts, and debug issues faster.

The PLG Stack

Promtail + Loki + Grafana: A lightweight alternative to the ELK stack, perfect for homelabs.

version: "3.8"
services:
  loki:
    image: grafana/loki:latest
    ports:
      - "3100:3100"
    volumes:
      - loki_data:/loki
    command: -config.file=/etc/loki/local-config.yaml

  promtail:
    image: grafana/promtail:latest
    volumes:
      - /var/log:/var/log:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - ./promtail-config.yml:/etc/promtail/config.yml
    command: -config.file=/etc/promtail/config.yml

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin

volumes:
  loki_data:
  grafana_data:

Promtail Configuration

# promtail-config.yml
server:
  http_listen_port: 9080

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
    relabel_configs:
      - source_labels: ['__meta_docker_container_name']
        target_label: container

Useful LogQL Queries

# All logs from a container
{container="nginx"}

# Errors only
{container=~".+"} |= "error"

# Count errors per container
sum by (container) (count_over_time({container=~".+"} |= "error" [1h]))