Collect MySQL logs with OpenTelemetry

Overview

MySQL writes an error log for startup, shutdown, and runtime problems, and optionally a slow query log. The OpenTelemetry Collector’s filelog receiver tails the error log, parses each entry, and ships the records to Osuite over OTLP. This page collects logs; for connection, query, and InnoDB metrics see Monitor MySQL with OpenTelemetry.

Prerequisites

• MySQL writing an error log to disk. On Debian and Ubuntu the default is /var/log/mysql/error.log; on RHEL and CentOS it is /var/log/mysqld.log.
• The OpenTelemetry Collector installed on the host, with read access to the log directory.
• An Osuite ingest token and endpoint — see Getting Started.

Collector config

This otel-collector.yaml tails the MySQL error log and parses the MySQL 8 log format. Adjust the include path for your distribution.

receivers:
  filelog/mysql_error:
    include:
      - /var/log/mysql/error.log
    start_at: end
    operators:
      - type: regex_parser
        regex: '^(?P<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z) +(?P<thread>\d+) \[(?P<level>\w+)\](?: \[(?P<error_code>[^\]]+)\])?(?: \[(?P<subsystem>[^\]]+)\])? (?P<message>.*)'
        timestamp:
          parse_from: attributes.timestamp
          layout_type: strptime
          layout: '%Y-%m-%dT%H:%M:%S.%fZ'
        severity:
          parse_from: attributes.level
          mapping:
            info:
              - System
              - Note
            warn: Warning
            error: Error

processors:
  batch: {}
  resourcedetection:
    detectors: [system]
  resource:
    attributes:
      - key: service.name
        value: mysql
        action: upsert

exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>

service:
  pipelines:
    logs:
      receivers: [filelog/mysql_error]
      processors: [batch, resourcedetection, resource]
      exporters: [otlp/osuite]

Parsing and enrichment

• Format assumption — the regex parses the MySQL 8 error log format (timestamp thread [level] [error-code] [subsystem] message, for example 2025-10-15T12:34:56.789012Z 0 [Warning] [MY-010055] [Server] ...). MySQL 5.7 uses the same shape but without the [error-code] and [subsystem] fields — the optional groups above handle both.
• Severity — MySQL 8 uses System, Note, Warning, and Error; the mapping translates them to the record’s SeverityNumber. See severity. On MySQL 5.7 the level [ERROR] maps through the same Error entry.
• UTC timestamps — MySQL 8 writes the error log timestamp in UTC with a trailing Z, which the %fZ layout parses directly.
• Slow query log — the slow query log (default /var/log/mysql/mysql-slow.log) is multi-line: each entry spans several # ... header lines followed by the SQL. To collect it, add a second filelog receiver with a multiline block whose line_start_pattern matches ^# Time:.
• Host and service attributes — the resourcedetection and resource processors tag each record with the host name and a stable service.name.

Verify in Osuite

What you should see

Within a minute, MySQL error records appear in the Logs Explorer tagged with service.name=mysql and the host name. Filtering by severity isolates Error and Warning entries, and the error_code attribute is available where MySQL emits one.

Troubleshooting

If timestamps fail to parse, confirm your server writes the error log timestamp in UTC (log_timestamps = UTC, the MySQL 8 default) — set to SYSTEM it emits local time and the trailing Z no longer applies. If records keep their whole line in the body, the regex did not match; test it against a real log line and confirm the format assumption above.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.