access-log-exporter

packaged by Chainguard

Chainguard Container for access-log-exporter

Converts web server access logs received over syslog into Prometheus metrics and optionally scrapes NGINX stub_status metrics.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/access-log-exporter:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Unlike upstream ghcr.io/jkroepke/access-log-exporter, which runs as root, cgr.dev/ORGANIZATION/access-log-exporter runs as UID 65532. Its /access-log-exporter entrypoint is a symlink to /usr/bin/access-log-exporter. When copying the executable into another image, copy /usr/bin/access-log-exporter and include its runtime dependencies. The image reads /config.yaml from its working directory, /.

The packaged configuration includes the simple, simple_upstream, and simple_uri_upstream presets. The Loki chart supplies its own loki preset.

Getting Started

Run the exporter with its packaged configuration:

docker run --name access-log-exporter --read-only \
  -p 4040:4040 -p 8514:8514/udp \
  cgr.dev/ORGANIZATION/access-log-exporter:latest

Configure your web server to send matching syslog access logs to UDP port 8514. Prometheus metrics are served at /metrics on port 4040; /health provides a health endpoint. See the upstream configuration examples for the required log format and metric definitions.

For an existing Grafana community Loki Helm chart deployment, enable the gateway metrics sidecar and override its image. Ensure your namespace has a chainguard-registry image pull secret with access to cgr.dev/ORGANIZATION/access-log-exporter. Create an override file:

cat > gateway-metrics-values.yaml <<'EOF'
imagePullSecrets:
  - name: chainguard-registry
gateway:
  enabled: true
  metrics:
    enabled: true
    image:
      registry: cgr.dev
      repository: ORGANIZATION/access-log-exporter
      tag: latest
EOF

Replace ORGANIZATION in the file with your organization's registry name. Apply the override to your existing loki release in the loki namespace, keeping the chart version already deployed. Replace CHART_VERSION accordingly:

helm repo add grafana-community https://grafana-community.github.io/helm-charts
helm repo update grafana-community
helm upgrade loki grafana-community/loki --namespace loki \
  --version CHART_VERSION --reuse-values --values gateway-metrics-values.yaml

The chart mounts the loki preset and configures the gateway to send syslog access logs to the exporter. Preserve any other image pull secrets your existing deployment needs in the override file.

Configuration

To supply your own configuration, mount it read-only at /config.yaml. Pass --preset if the preset you want is not named simple. The file must be readable by UID 65532.

To enable HTTPS, mount a certificate and private key readable by UID 65532, and pass --web.tls-cert-file and --web.tls-key-file with their container paths. For example, with those files in a local tls directory:

docker run --rm --read-only -p 4040:4040 -p 8514:8514/udp \
  -v "$PWD/tls:/tls:ro" cgr.dev/ORGANIZATION/access-log-exporter:latest \
  --web.tls-cert-file=/tls/cert.pem --web.tls-key-file=/tls/key.pem

Stop the earlier container before running this example to free the published ports. Keep the private key restricted to the user or group running the container.

Documentation and Resources

• Upstream repository and configuration examples
• Grafana community Helm charts

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.