Logcore

Appearance

Service file examples ​

Copy any of these files into the services folder, adjust the paths, then run configcheck and restart the agent.

Nginx ​

yaml
# services/nginx.yaml
name: nginx
paths:
  - /var/log/nginx/access.log
  - /var/log/nginx/error.log
exclude:
  - 'GET /(health|favicon\.ico)'
status:
  overrides:
    - match: '" 5\d\d '
      status: error
    - match: '" 4\d\d '
      status: warning

Apache ​

yaml
# services/apache.yaml
name: apache
paths:
  - /var/log/apache2/*.log      # Debian/Ubuntu
  - /var/log/httpd/*_log        # RHEL family
exclude_paths: ["*.gz", "*.[0-9]"]

System logs ​

yaml
# services/syslog.yaml
name: syslog
paths:
  - /var/log/syslog       # Debian/Ubuntu
  - /var/log/messages     # RHEL family
  - /var/log/auth.log
tags: ["source:system"]

Java / Spring Boot with stack traces ​

yaml
# services/orders.yaml
name: orders
path: /opt/orders/logs/*.log
multiline:
  pattern: '^\d{4}-\d{2}-\d{2}'
status:
  overrides:
    - match: 'OutOfMemoryError|StackOverflowError'
      status: critical
tags: ["team:orders", "lang:java"]

Python application ​

yaml
# services/api.yaml
name: api
path: /srv/api/logs/**/*.log
multiline:
  pattern: '^\d{4}-\d{2}-\d{2}'     # "Traceback (most recent call last):" lines are joined to the event above
exclude:
  - 'GET /healthz'

Node.js with PM2 ​

yaml
# services/web.yaml
name: web
paths:
  - /home/deploy/.pm2/logs/web-out*.log
  - /home/deploy/.pm2/logs/web-error*.log

Give the agent read access first:

sh
sudo setfacl -m u:logcore-agent:x /home/deploy /home/deploy/.pm2
sudo setfacl -R -m u:logcore-agent:rX /home/deploy/.pm2/logs
sudo setfacl -R -d -m u:logcore-agent:rX /home/deploy/.pm2/logs

Docker containers (json-file driver) ​

yaml
# services/docker.yaml
name: docker
path: /var/lib/docker/containers/*/*-json.log
tags: ["source:docker"]

This needs root access, so install with LOGCORE_RUN_AS_ROOT=true. Each line is a JSON object that contains the container's log line.

Only errors from a noisy file ​

yaml
# services/batch.yaml
name: batch
path: /var/log/batch/*.log
include:
  - '(?i)\b(error|fatal|exception|failed)\b'

A folder of failure files ​

yaml
# services/kds_sucess.yaml
name: kds_sucess
path: /KDS_system/failure/*log

*log matches every file whose name ends in log, such as orders.log or 2026-11-11_failurelog. To mark everything from this service as an error:

yaml
status:
  detect: none
  default: error

MySQL / MariaDB ​

yaml
# services/mysql.yaml
name: mysql
paths:
  - /var/log/mysql/error.log
  - /var/log/mysql/mysql-slow.log
multiline:
  pattern: '^(# Time:|\d{4}-\d{2}-\d{2}|\d{6} )'

PostgreSQL ​

yaml
# services/postgres.yaml
name: postgres
path: /var/log/postgresql/*.log
multiline:
  pattern: '^\d{4}-\d{2}-\d{2} '
status:
  overrides:
    - match: '\b(FATAL|PANIC):'
      status: critical

Windows: IIS ​

yaml
# C:\ProgramData\Logcore\services\iis.yaml
name: iis
path: 'C:\inetpub\logs\LogFiles\**\*.log'
exclude:
  - '^#'          # W3C header lines

Windows: .NET app ​

yaml
# C:\ProgramData\Logcore\services\billing.yaml
name: billing
path: 'D:\Apps\Billing\logs\*.txt'
multiline:
  pattern: '^\d{4}-\d{2}-\d{2}'
tags: ["team:billing"]