Collect Redis logs with OpenTelemetry

Overview

Redis writes a single server log covering startup, persistence, replication, and warnings. The OpenTelemetry Collector’s filelog receiver tails that log, parses each line, and ships the records to Osuite over OTLP. This page collects logs; for memory, keyspace, and command metrics see Monitor Redis with OpenTelemetry.

Prerequisites

• Redis configured to log to a file. Set logfile in redis.conf — on Debian and Ubuntu the default is /var/log/redis/redis-server.log; on RHEL and CentOS it is /var/log/redis/redis.log.
• The OpenTelemetry Collector installed on the host, with read access to the log directory.
• An Osuite ingest token and endpoint — see Getting Started.

Note

The official Redis container image logs to stdout when logfile is empty (the default). In containers, collect that stream with Docker container logs or Kubernetes pod logs instead of tailing a file.

Collector config

This otel-collector.yaml tails the Redis log and parses its line format, including the single-character log-level symbol. Adjust the include path for your distribution.

receivers:
  filelog/redis:
    include:
      - /var/log/redis/redis-server.log
    start_at: end
    operators:
      - type: regex_parser
        regex: '^(?P<pid>\d+):(?P<role>[A-Z]) (?P<timestamp>\d{2} \w{3} \d{4} \d{2}:\d{2}:\d{2}\.\d{3}) (?P<level>[.\-*#]) (?P<message>.*)'
        timestamp:
          parse_from: attributes.timestamp
          layout_type: strptime
          layout: '%d %b %Y %H:%M:%S.%f'
        severity:
          parse_from: attributes.level
          mapping:
            debug: '.'
            info:
              - '-'
              - '*'
            warn: '#'

processors:
  batch: {}
  resourcedetection:
    detectors: [system]
  resource:
    attributes:
      - key: service.name
        value: redis
        action: upsert

exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>

service:
  pipelines:
    logs:
      receivers: [filelog/redis]
      processors: [batch, resourcedetection, resource]
      exporters: [otlp/osuite]

Parsing and enrichment

• Format assumption — the regex parses the standard Redis log line (pid:role date time.ms level message, for example 1234:M 15 Oct 2025 12:34:56.789 * Ready to accept connections). The role character is M (master), S (replica), C (child), or X (sentinel).
• Severity symbols — Redis encodes the level as a single character: . debug, - verbose, * notice, and # warning. The mapping folds these into the record’s SeverityNumber (verbose and notice both map to info). See severity.
• Timestamps — the log time has no zone; the parser reads it as the Collector host’s local time. Set the same zone on the Collector host as on the Redis server.
• Host and service attributes — the resourcedetection and resource processors tag each record with the host name and a stable service.name.

Verify in Osuite

What you should see

Within a minute, Redis records appear in the Logs Explorer tagged with service.name=redis and the host name. Filtering by severity isolates warnings (#), and the role attribute distinguishes master from replica output.

Troubleshooting

If no records arrive, confirm logfile in redis.conf points at the path in include and is not empty — an empty logfile sends output to stdout, which a file tail will not see. If records keep their whole line in the body, the regex did not match; test it against a real log line and confirm the format assumption above.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.