# Collects Docker container logs and forwards them to VictoriaLogs

# Bind-mounted by docker-compose.yml (dev) and installed into /srv/app/<env>/

# by the Ansible `app` role (production)

sources:

  docker:

    type: docker_logs

transforms:

  parse_json_message:

    type: remap

    inputs: [docker]

    # pino writes one JSON object per line — when a line parses we lift its

    # fields to the top level so level/msg/userId become queryable in

    # VictoriaLogs, otherwise the raw line stays as the message

    source: |

      parsed, err = parse_json(.message)

      if err == null && is_object(parsed) {

        . = merge(., parsed) ?? .

      }

sinks:

  victorialogs:

    type: elasticsearch

    inputs: [parse_json_message]

    endpoints: ["http://victorialogs:9428/logs/insert/elasticsearch/"]

    mode: bulk

    api_version: v8

    compression: gzip

    healthcheck:

      enabled: false

    request:

      headers:

        VL-Stream-Fields: label.com.docker.compose.service

        VL-Time-Field: timestamp

        VL-Msg-Field: msg,message,_msg

        AccountID: "0"

        ProjectID: "0"