Collecting Application Logs

So far, our courier has been picking up the building’s shared mail — the post that lands in the lobby for everyone. But your own apartment has its own mailbox, tucked away on another floor, and nobody is collecting from it yet. If you want that mail too, you have to add your mailbox to the courier’s route.

Applications are like that private mailbox. Up until now, Alloy has been collecting system logs under /var/log. Your application, however, typically writes its logs to its own file and directory. For example:

~/app/app.log

POST /login 200
GET /photos 200
POST /upload 201
GET /feed 200
POST /photos 201

Those application logs aren’t reaching Loki yet because Alloy doesn’t know this path exists. To collect them, add the application’s file path and a tailing source to Alloy’s configuration so the lines are forwarded into the same pipeline that already sends system logs to Loki. What you need to add

A file match — a pattern or path that tells Alloy which files to watch.
A tailing source — reads newly appended lines from the file and forwards them to the existing log writer/pipeline.

A file match tells the agent which files to watch. A tailing source reads new lines as they are appended and forwards them to the existing log pipeline so application logs arrive in Loki alongside system logs.

Example (illustrative) configuration

The example below shows a minimal, generic Alloy-style configuration to watch and tail an application log file and use the existing loki writer. Adapt keys and paths to match your Alloy agent configuration format and the user account that runs the process.

# Example — adapt to your Alloy agent config syntax
file_matches:
  - '/home/ubuntu/app/app.log'

sources:
  - name: app_tail
    type: tail
    path: '/home/ubuntu/app/app.log'
    read_from: end      # start tailing new lines only
    parser:
      type: regex
      expression: '^(?P<method>POST|GET) (?P<path>/\S+) (?P<status>\d{3})$'

writers:
  - name: loki
    type: loki
    endpoint: 'https://loki.example.com/loki/api/v1/push'

routes:
  - from: app_tail
    to: loki

Steps to enable collection

Add the file match and tailing source to the Alloy configuration file (adapt paths and keys to your environment).
Ensure the agent process has read permission for the application’s log file (see warning below).
Restart the Alloy agent so it picks up the new configuration.
Verify new application log entries appear in Loki/Grafana using the same labels/timestamps as your system logs.

Quick summary

Component	Purpose	Example
File match	Identifies the application log file(s) to monitor	`/home/ubuntu/app/app.log`
Tailing source	Reads newly appended lines and emits them into the pipeline	`type: tail`, `path: '/home/ubuntu/app/app.log'`
Writer/pipeline	Sends parsed logs to Loki	`writer: loki` or `endpoint: https://loki.example.com`

Make sure the Alloy agent user has permission to read your application’s log file (common issues: files owned by a different user, or logs under protected directories). After updating config, restart the agent and check the agent logs for errors referencing the configured path or file_matches.

After you restart the agent, the application’s logs will flow in alongside the system logs into Loki. Use Grafana to query and visualize those logs using the same labels or additional labels you add at the source. Links and references

Course Introduction

Grafana Loki Essentials

Grafana Loki on Kubernetes

Collecting Application Logs

Watch Video