Promtail

"Compose"

promtail:                            
    image: grafana/promtail
    container_name: promtail
    networks:
      internal:
        ipv4_address: 192.168.x.x                 
    environment:
      TZ: Europe/Rome
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log/auth.log:/var/log/auth.log
      - ./config.yml:/etc/promtail/config.yml 
    restart: always 

"Config File"

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /var/lib/positions.yaml

clients:
  - url: http://url-loki:0000/loki/api/v1/push

scrape_configs:
  - job_name: ssh_logs
    static_configs:
      - targets:
          - localhost
        labels:
          job: ssh
          host: domain.it
          __path__: /var/log/auth.log 

  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
        refresh_interval: 15s
    relabel_configs:
      - source_labels: [__meta_docker_container_name]
        target_label: container
        replacement: '$1'
      - source_labels: [__meta_docker_container_log_path]
        target_label: __path__