# Question about docker labels

**URL:** <https://discourse.crowdsec.net/t/question-about-docker-labels/2741>\
**Category:** crowdsec\
**Created:** [January 6, 2026, 6:59pm UTC](https://discourse.crowdsec.net/t/question-about-docker-labels/2741 "2026-01-06T18:59:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![icanthelp](https://avatars.discourse-cdn.com/v4/letter/i/b38774/32.png) [@icanthelp](https://discourse.crowdsec.net/u/icanthelp)\
**Post date:** [January 6, 2026, 6:59pm UTC](https://discourse.crowdsec.net/t/question-about-docker-labels/2741/1 "2026-01-06T18:59:22Z")

</div>

I have an Emby server that I want to protect.  
Luckily, I have found [this crowdsec collection](https://app.crowdsec.net/hub/author/LePresidente/collections/emby) for it.  
I have added the two crowdsec labels and the traefik middlewares label you see here:

```auto
    labels:
      traefik.http.routers.emby.tls: true
      traefik.http.routers.emby.middlewares: crowdsec@file
      traefik.http.services.emby.loadbalancer.server.port: 8096
      crowdsec.enable: true
      crowdsec.labels.type: emby

```

Now my question is: how does crowdsec know how to get to the emby log file? Am I not supposed to provide a filepath for the log?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [January 7, 2026, 4:06pm UTC](https://discourse.crowdsec.net/t/question-about-docker-labels/2741/2 "2026-01-07T16:06:02Z")

</div>

> [@icanthelp](#):
>
> Now my question is: how does crowdsec know how to get to the emby log file? Am I not supposed to provide a filepath for the log?

Using docker labels instructs crowdsec to read the stdout of the container, if the logs go to a file then you must mount the file from the container into crowdsec itself. Or if emby supports writing to stdout then set that.

---

<div class="post-metadata">

**Author:** ![icanthelp](https://avatars.discourse-cdn.com/v4/letter/i/b38774/32.png) [@icanthelp](https://discourse.crowdsec.net/u/icanthelp)\
**Post date:** [January 7, 2026, 7:12pm UTC](https://discourse.crowdsec.net/t/question-about-docker-labels/2741/3 "2026-01-07T19:12:44Z")

</div>

I see. Ok. But then do you have any idea what is this LOG\_FILE environment variable that is mentioned in the [emby collection web page](https://app.crowdsec.net/hub/author/LePresidente/collections/emby)? I’m wondering because `cscli metrics show acquisition` says none of the 326 lines read for docker:/emby were parsed, so am I correct in guessing it’s not finding the pattern it’s looking for in the emby container stdout?