Issue with filelog Receiver: "no files match the configured criteria"

[NamanGajjar26]

Component(s)

receiver/filelog

Describe the issue you're reporting

Description:

I'm encountering an issue with the filelog receiver in the OpenTelemetry Collector when attempting to read log files. The error message indicates that no files match the configured criteria, even though the file exists and contains logs.

Here is the error message:

fileconsumer/file.go:49 finding files {"kind": "receiver", "name": "filelog", "data_type": "logs", "component": "fileconsumer", "error": "no files match the configured criteria"}

The log file contains the following entries:

 2024-12-27T18:18:34.782112+05:30 administrator-B450M-DS3H-WIFI systemd[1]: Started fwupd.service - Firmware update daemon.
 2024-12-27T18:18:34.806715+05:30 administrator-B450M-DS3H-WIFI systemd[1]: fwupd-refresh.service: Deactivated successfully.
 2024-12-27T18:18:34.806958+05:30 administrator-B450M-DS3H-WIFI systemd[1]: Finished fwupd-refresh.service - Refresh fwupd metadata and update motd.

Here is the configuration I am using:

receivers:
    filelog:
      include:
        - /var/log/mysyslog.log
      start_at: beginning
      operators:
        - type: regex_parser
          regex: '^(?P<timestamp>[^\s]+)\s(?P<hostname>[^\s]+)\s(?P<service>[^\s]+):\s(?P<message>.*)$'
          timestamp:
            parse_from: attributes.timestamp
            layout: '%Y-%m-%dT%H:%M:%S.%f'
          field_renames:
            attributes:
              hostname: host.name
              service: service.name     

pipelines:
  logs:
    receivers: [filelog]
    processors: [batch]
    exporters: [opensearch/log]

[github-actions]

Pinging code owners:

• receiver/filelog: @djaglowski

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[dehaansa]

Are you certain that the user that the collector is running as has permissions to read the log file? Can you triple check with an ls -la in the /var/log/ directory or just for the file itself?

[NamanGajjar26]

I want to get /var/log/sayslog from host machine
I copied this mysyslog.log file and it is getting in the container

[rshiva777]

facing the same issue

"2025-01-19T14:00:31.599Z debug fileconsumer/file.go:123 finding files {"kind": "receiver", "name": "filelog", "data_type": "logs", "component": "fileconsumer", "error": "no files match the configured criteria"}"

below is my receiver section:

  config: |
    receivers:
      filelog:
        include:
          - /var/log/pods/*/*/*.log
          - /var/log/messages