> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Collecting Application Logs

> Configuring Alloy to watch and tail application log files and forward them to Grafana Loki for unified log collection and visualization

So far, our courier has been picking up the building's shared mail — the post that lands in the lobby for everyone.

But your own apartment has its own mailbox, tucked away on another floor, and nobody is collecting from it yet.

If you want that mail too, you have to add your mailbox to the courier's route.

![A slide titled "Collecting Application Logs" showing a simple multi-story building diagram with envelope icons and dashed arrows indicating log collection paths. A small illustrated person/avatar appears at the bottom left.](https://mintcdn.com/kodekloud-c4ac6d9a/dEcIUoAxuol-3ZBK/images/Grafana-Loki/Grafana-Loki-Essentials/Collecting-Application-Logs/collecting-application-logs-multi-story-building.jpg?fit=max\&auto=format\&n=dEcIUoAxuol-3ZBK\&q=85\&s=46af1899060648dd7321effcd8393afe)

Applications are like that private mailbox.

Up until now, Alloy has been collecting system logs under `/var/log`. Your application, however, typically writes its logs to its own file and directory. For example:

```text theme={null}
~/app/app.log

POST /login 200
GET /photos 200
POST /upload 201
GET /feed 200
POST /photos 201
```

Those application logs aren't reaching [Loki](https://learn.kodekloud.com/user/courses/grafana-loki) yet because Alloy doesn't know this path exists. To collect them, add the application's file path and a tailing source to Alloy's configuration so the lines are forwarded into the same pipeline that already sends system logs to Loki.

What you need to add

* A file match — a pattern or path that tells Alloy which files to watch.
* A tailing source — reads newly appended lines from the file and forwards them to the existing log writer/pipeline.

A file match tells the agent which files to watch. A tailing source reads new lines as they are appended and forwards them to the existing log pipeline so application logs arrive in Loki alongside system logs.

Example (illustrative) configuration

* The example below shows a minimal, generic Alloy-style configuration to watch and tail an application log file and use the existing `loki` writer. Adapt keys and paths to match your Alloy agent configuration format and the user account that runs the process.

```yaml theme={null}
# Example — adapt to your Alloy agent config syntax
file_matches:
  - '/home/ubuntu/app/app.log'

sources:
  - name: app_tail
    type: tail
    path: '/home/ubuntu/app/app.log'
    read_from: end      # start tailing new lines only
    parser:
      type: regex
      expression: '^(?P<method>POST|GET) (?P<path>/\S+) (?P<status>\d{3})$'

writers:
  - name: loki
    type: loki
    endpoint: 'https://loki.example.com/loki/api/v1/push'

routes:
  - from: app_tail
    to: loki
```

Steps to enable collection

1. Add the file match and tailing source to the Alloy configuration file (adapt paths and keys to your environment).
2. Ensure the agent process has read permission for the application's log file (see warning below).
3. Restart the Alloy agent so it picks up the new configuration.
4. Verify new application log entries appear in Loki/Grafana using the same labels/timestamps as your system logs.

Quick summary

| Component | Purpose | Example |
| - | - | - |
| File match | Identifies the application log file(s) to monitor | `/home/ubuntu/app/app.log` |
| Tailing source | Reads newly appended lines and emits them into the pipeline | `type: tail`, `path: '/home/ubuntu/app/app.log'` |
| Writer/pipeline | Sends parsed logs to Loki | `writer: loki` or `endpoint: https://loki.example.com` |

Make sure the Alloy agent user has permission to read your application's log file (common issues: files owned by a different user, or logs under protected directories). After updating config, restart the agent and check the agent logs for errors referencing the configured `path` or `file_matches`.

After you restart the agent, the application's logs will flow in alongside the system logs into Loki. Use Grafana to query and visualize those logs using the same labels or additional labels you add at the source.

Links and references

* [Grafana Loki documentation](https://grafana.com/docs/loki/)
* [Grafana Loki — KodeKloud course](https://learn.kodekloud.com/user/courses/grafana-loki)

> **[Watch Video](https://learn.kodekloud.com/user/courses/grafana-loki/module/d9262c89-9213-4e21-8599-d54b9c773885/lesson/04d86ee9-5938-4ffc-9b95-0a38b9921536)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.