Can i send alerts of the pure logs stored in a Docker file?

Grafana Alerting
1

  • What Grafana version and what operating system are you using?

    • Grafana Version: v12.1.0
    • Operating System: Linux (Docker container)
    • Data Source: Loki with Promtail log collection

  • What are you trying to achieve?

    • I’m trying to send email alerts with complete raw log content (including stack traces) when errors are detected, instead of just metadata like filename and job name.

  • How are you trying to achieve it?

  1. Alert Rule Configuration:

    • Query: count_over_time({job="docker_prms_test"} |~ "ERROR" [5m])

    • Reduce: Function: Last, Mode: Strict

    • Threshold: IS ABOVE 0

    • SMTP configured and tested working

  2. Notification Template:
**🚨 ALERTA - {{ $value }} ERRORES DETECTADOS 🚨**

**Sistema:** {{ $labels.job }}
**Timestamp:** {{ $startsAt }}
**Archivo:** {{ $labels.filename }}

**📝 LOG COMPLETO DEL ERROR:**
{{ printf "{job=\"%s\"} |= \"ERROR\" | limit 1" $labels.job | query | first | value }}

**🔧 ACCIÓN INMEDIATA:**
1. Investigar error en logs
2. Verificar: {{ $labels.filename }}
3. Revisar conexiones API

  • What happened?

    • Alerts trigger correctly when errors are detected (status shows “Firing”)
    • Email notifications are delivered via SMTP
    • BUT the email contains only metadata instead of actual log content:

      • Shows: {filename="/var/lib/docker/containers/.../container-cached.log", job="docker_prms_test"}

      • Instead of actual log: stdout [Nest] 25 - 09/11/2025, 6:15:47 PM ERROR [ClarisaApiConnection] AxiosError: Request failed with status code 500

  • What did you expect to happen?

    • Expected the email to contain the complete raw log line with error details and stack trace, not just filesystem metadata.

  • Can you copy/paste the configuration(s) that you are having problems with?

    • Loki Log Example (what we receive):

      text

      TIMESTAMP [Nest] 1  - e[39m09/12/2025, 2:07:50 PM e[32m    LOGe[39m e[38;5;3m[ProgramService] e[39me[32mfilterStatus is runinge[39m

      Current Alert Output:

      text

      {filename="/var/lib/docker/containers/.../container-cached.log", job="docker_prms_test"}

      Desired Alert Output:

      text

      [Nest] 25 - 09/11/2025, 6:15:47 PM ERROR [ClarisaApiConnection] AxiosError: Request failed with status code 500
2

Currently, it’s not possible but Grafana is working on a new feature called “alert enrichment”. Once it is released you will be able to add additional context to the alert. Stay tuned.