Searching through disjointed log files across multiple VPS instances, TrueNAS servers, and Docker containers with journalctl and grep is time-consuming and inefficient during outages.
Modern infrastructure aggregates all system, container, and edge firewall logs into a centralized, searchable telemetry pipeline using Vector (log collector) and Grafana Loki.
⚡ Quick Runbook: 60-Second Implementation
TL;DR: Copy and deploy the baseline production definition directly onto your host:
{
"log-driver": "json-file",
"log-opts": {
"max-size": "20m",
"max-file": "5"
}
}1. The Logging Pipeline Architecture
- Docker Daemon & Journald: Applications emit logs to stdout/stderr in JSON format.
- Vector Agent: A lightweight Rust-based log shipper running on each host reads Docker sockets and systemd journal, parses timestamps, strips noise, and ships compressed streams.
- Grafana Loki: Indexes metadata labels rather than full text, keeping memory footprint low and storage costs fractionally lower than Elasticsearch.
2. Docker Logging Driver Configuration
Configure Docker daemon globally in /etc/docker/daemon.json to enforce log rotation and prevent disk exhaustion:
{
"log-driver": "json-file",
"log-opts": {
"max-size": "20m",
"max-file": "5"
}
}Related Runbooks in This Series
- Modern Homelab Observability: Netdata Telemetry & Uptime Kuma Health Checks
- Centralized Homelab Logging: Vector, Grafana Loki, and Structured JSON Telemetry
- Homelab Notification Pipelines: Multi-Channel Alerts with Webhooks & Ntfy
- Networked UPS Management: Network UPS Tools (NUT) and Graceful Automated Shutdown
- Predictive Drive Failure & S.M.A.R.T. Health Monitoring with smartd and Scrutiny