Promtail
inari.promtail
A Docker Compose file for Promtail alone, generated from the catalog and checked by the safety inspector. No account needed.
Log shipping agent for Loki that discovers log files and container streams, attaches labels, applies parsing stages and pushes lines to an ingest endpoint. Reached end of life in March 2026.
Promtail tails files and container log streams, attaches a label set to each stream and pushes lines to Loki over its push API, keeping a positions file so a restart resumes where it stopped rather than replaying everything. A pipeline of stages parses lines, extracts fields into labels, rewrites timestamps and drops what is not wanted before anything is sent. Grafana Labs deprecated it in favour of Alloy, its OpenTelemetry Collector distribution, and Promtail reached end of life on 2 March 2026 with no further fixes or security patches issued. Alloy provides a conversion command that translates an existing Promtail configuration.
You know it worked when
- The agent starts and its own metrics endpoint reports discovered targets.
- Those targets appear on its targets page with the expected labels.
- Lines pushed to Loki are returned by a query for those labels.
- A pipeline stage's extracted field is visible on the shipped lines.
- A restart resumes from the recorded position rather than re-sending old lines.
Known sharp edges
- End of life since 2 March 2026: no security patches or bug fixes will be issued, which makes it a poor choice for a new deployment.
- The positions file must persist, or a restart re-reads every file from the beginning and duplicates the entire history into Loki.
- Labels derived from parsed log content are the quickest way to destroy a Loki instance through cardinality.
- It needs read access to host log paths and the container log directory, and a missing mount produces an agent that runs quietly and ships nothing.