Log files (filelog)

Tail files with your own OpenTelemetry Collector (contrib) and forward to the gateway over OTLP/HTTP. Needs an ingestion key with the ingest:logs scope. Set WT_OTLP_ENDPOINT (for example https://ingest.example.com) and WT_INGEST_KEY.

receivers:
  filelog:
    include: [/var/log/app/*.log]
    start_at: end
    storage: file_storage
    operators:
      - type: json_parser
        if: body matches "^\\{"
        timestamp:
          parse_from: attributes.time
          layout: "%Y-%m-%dT%H:%M:%S.%LZ"
        severity:
          parse_from: attributes.level
extensions:
  file_storage:
    directory: /var/lib/otelcol/file_storage
processors:
  resource:
    attributes:
      - key: service.name
        value: my-app
        action: upsert
  batch: {}
exporters:
  otlphttp:
    endpoint: ${env:WT_OTLP_ENDPOINT}
    headers:
      Authorization: "Bearer ${env:WT_INGEST_KEY}"
service:
  extensions: [file_storage]
  pipelines:
    logs:
      receivers: [filelog]
      processors: [resource, batch]
      exporters: [otlphttp]

Notes:

• Do not set wt.* attributes; the gateway deletes them.

• The file_storage extension (wired above through storage:) keeps offsets across restarts; without it offsets live in memory and start_at: end skips lines written while the collector was down. Make the directory writable by the collector user.

• Delivery is at-least-once.

Status: structure-checked, not yet run against the real agent.