cedricandClaude Opus 5.5
087d9e7b30
Files source (source_type=file), declared in Settings > Log sources > Log files (/data/files.json, 50 at most): name (= app), path as mounted in the container (file or glob, rotated copies .1/.gz left out, 200 files per glob), format, optional host, switch. - formats: plain text (level detected, leading timestamp read and removed), JSON lines (msg/time/level keys, numeric pino levels, other keys as fields, nested ones dotted), logfmt, access log CLF (nginx, Apache, Traefik CLF with router/backend/duration), Traefik access log in JSON (summary "GET host/path 200 · 12.5 ms · router · client"), regular expression with named groups time/level/msg/host/app/status; 5xx = err, 4xx = warning; fields named like LogStream's own renamed field_<name> - indented lines (text) and non-matching lines (regex) added to the previous entry, which waits 2 s for them - inode + offset per file in /data/files-state.json, rotation (end of .1 read first), copytruncate, file renamed within the glob; last FILES_BACKFILL (1h) of dated lines read when turned on, new files read from their start - status per file (files followed, entries read, not found / permission) UI: rows with switch, name, path, format, host (regex field when needed), status line; green edge, tint and FILE badge in the list, "Files" in the source filter, HTTP fields first in the details, FR/EN. docker-compose, .env.example and README (EN/FR): mounts, formats, FILES_BACKFILL. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
74 lines
3.8 KiB
Bash
74 lines
3.8 KiB
Bash
# Copy this file to .env and adjust it.
|
|
SYSLOG_PORT=5514
|
|
HTTP_PORT=8989
|
|
TZ=Europe/Paris
|
|
# How long logs are kept (e.g. 7d, 30d, 12w, 1y)
|
|
RETENTION=30d
|
|
# Web UI authentication: local (login page with the account below, or none) or oidc (OpenID Connect provider)
|
|
AUTH_MODE=local
|
|
# local mode: user and password (empty = no authentication)
|
|
AUTH_USER=
|
|
AUTH_PASS=
|
|
# local mode: optional read-only account (can search and export, cannot change tags, sources or purge)
|
|
AUTH_VIEWER_USER=
|
|
AUTH_VIEWER_PASS=
|
|
# local mode: PNG logo shown on the login page, path inside the container (empty = no logo).
|
|
# Mount the file in docker-compose.yml, e.g. ./logo.png:/config/logo.png:ro, then LOGIN_LOGO=/config/logo.png
|
|
LOGIN_LOGO=
|
|
|
|
# Ready-made color tags offered in Settings > Filters (see docs/presets.md).
|
|
# Empty: /data/presets.json if present, else the built-in list. To use your own file,
|
|
# mount it in docker-compose.yml, e.g. ./presets.json:/config/presets.json:ro
|
|
PRESETS_FILE=
|
|
# Session lifetime, both modes (e.g. 8h, 24h)
|
|
SESSION_TTL=12h
|
|
# oidc mode: issuer URL exactly as the provider announces it
|
|
# (Keycloak: https://sso.example.org/realms/<realm>, Authentik: https://auth.example.org/application/o/<slug>/)
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
# Callback URL of logstream, to register in the provider (path free, /auth/callback recommended)
|
|
OIDC_REDIRECT_URL=https://logs.example.org/auth/callback
|
|
# Requested scopes (openid is always added)
|
|
OIDC_SCOPES=openid profile email
|
|
# oidc mode: only members of this group are admins, the others are read-only (empty = everyone is admin).
|
|
# The groups come from the ID token claim OIDC_GROUPS_CLAIM (default groups)
|
|
OIDC_ADMIN_GROUP=
|
|
OIDC_GROUPS_CLAIM=groups
|
|
# Reverse DNS: show host names instead of IP addresses (on/off)
|
|
RDNS=on
|
|
# DNS server used for reverse lookups (e.g. your router: 192.168.1.1). Empty = system resolver
|
|
DNS_SERVER=
|
|
# Allow "Delete all logs" in Settings (true/false)
|
|
ALLOW_PURGE=false
|
|
# Maximum number of rows in a CSV export
|
|
EXPORT_MAX=100000
|
|
# Collect the logs of the Docker containers of this machine (on/off)
|
|
DOCKER_LOGS=on
|
|
# History read from a container seen for the first time (e.g. 30m, 1h, 24h; 0 = only new lines)
|
|
DOCKER_BACKFILL=1h
|
|
# Host system logs (enable them in Settings > Sources)
|
|
# Group allowed to read the host logs: 4 = adm on Debian/Ubuntu; or the systemd-journal group
|
|
# (getent group systemd-journal | cut -d: -f3)
|
|
HOST_LOGS_GID=4
|
|
# History read when the source is turned on (e.g. 30m, 1h, 24h; 0 = only new entries)
|
|
HOST_LOGS_BACKFILL=1h
|
|
# Kernel messages of the host (dmesg, enable them in Settings > Sources). The container needs
|
|
# /dev/kmsg: uncomment "devices" in docker-compose.yml. When the host has
|
|
# kernel.dmesg_restrict=1 (default on Debian/Ubuntu), either run on the host
|
|
# sysctl -w kernel.dmesg_restrict=0 (persist it in /etc/sysctl.d/)
|
|
# or run the container as root with the SYSLOG capability ("user" and "cap_add" in docker-compose.yml).
|
|
# History read when the source is turned on (e.g. 30m, 1h, 24h; 0 = only new messages)
|
|
DMESG_BACKFILL=1h
|
|
# Linux audit log of the host (auditd, enable it in Settings > Sources). Uncomment the
|
|
# /var/log/audit volume in docker-compose.yml and let the container read the file:
|
|
# log_group = adm in /etc/audit/auditd.conf, and chgrp adm + chmod 750 on /var/log/audit.
|
|
# History read when the source is turned on (e.g. 30m, 1h, 24h; 0 = only new events)
|
|
AUDIT_BACKFILL=1h
|
|
# Host name of the audit events (empty: node= of the records, else /host/etc/hostname, else localhost)
|
|
AUDIT_HOST=
|
|
# Log files of other programs (Traefik, nginx, applications…), declared in Settings > Log sources >
|
|
# Log files: mount their directory read-only in docker-compose.yml (e.g. /var/log/traefik:/logs/traefik:ro).
|
|
# History read when a file is turned on (e.g. 30m, 1h, 24h; 0 = only new lines)
|
|
FILES_BACKFILL=1h
|