root user note

Author: gingerwizard

docs/use-cases/observability/clickstack/config.md

@@ -164,7 +164,7 @@ The following settings are available for each source:
 | `Service Name Expression`       | Expression or column for the service name.                                                                             | Yes      | Yes                         | `ServiceName`            |
 | `Resource Attributes Expression`| Expression or column for resource-level attributes.                                                                    | Yes      | Yes                         | `ResourceAttributes`     |
 | `Event Attributes Expression`   | Expression or column for event attributes.                                                                             | Yes      | Yes                         | `SpanAttributes`         |
-| `Span Events Expression`        | Expression to extract span events. Typically a `Nested` type column.                                                   | Yes      | Yes                         | `Events`                 |
+| `Span Events Expression`        | Expression to extract span events. Typically a `Nested` type column. This allows rendering of exception stack traces with supported language SDKs.                                                   | Yes      | Yes                         | `Events`                 |
 | `Implicit Column Expression`   | Column used for full-text search if no field is specified (Lucene-style). Typically the log body.  | Yes  | Yes  | `SpanName`|
 
 

docs/use-cases/observability/clickstack/example-datasets/local-data.md

@@ -87,11 +87,15 @@ receivers:
 
 exporters:
   otlp:
-    endpoint: host.docker.internal:4317
+    endpoint: localhost:4317
     headers:
       authorization: <YOUR_INGESTION_API_KEY>
     tls:
       insecure: true
+    sending_queue:
+      enabled: true
+      num_consumers: 10
+      queue_size: 262144  # 262,144 items × ~8 KB per item ≈ 2 GB
 
 service:
   pipelines:
@@ -120,14 +124,19 @@ For more details on the OpenTelemetry (OTel) configuration structure, we recomme
 Run the following docker command to start an instance of the OTel collector.
 
 ```bash
-docker run --rm -it \
+docker run --network=host --rm -it \
+  --user 0:0 \
   -v "$(pwd)/otel-file-collector.yaml":/etc/otel/config.yaml \
   -v /var/log:/var/log:ro \
   -v /private/var/log:/private/var/log:ro \
   otel/opentelemetry-collector-contrib:latest \
   --config /etc/otel/config.yaml
 ```
 
+:::note Root user
+We run the collector as the root user to access all system logs—this is necessary to capture logs from protected paths on Linux-based systems. However, this approach is not recommended for production. In production environments, the OpenTelemetry Collector should be deployed as a local agent with only the minimal permissions required to access the intended log sources.
+:::
+
 The collector will immediately begin collecting local system logs and metrics.
 
 ## Explore system logs {#explore-system-logs}

docs/use-cases/observability/clickstack/getting-started.md

@@ -45,11 +45,11 @@ docker run -p 8080:8080 -p 4317:4317 -p 4318:4318 docker.hyperdx.io/hyperdx/hype
 ```
 
 :::note Persisting data and settings
-To persist data and settings across restarts of the container, users can modify the above docker command to mount the paths `/data/db`, `/var/lib/clickhouse` and `/var/log/clickhouse-server`. For example:
+To persist data and settings across restarts of the container, users can modify the above docker command to mount the paths `/data/db`, `/var/lib/clickhouse` and `/var/log/clickhouse-server`. 
+
+For example:
 
 ```bash
-# ensure directories exist
-mkdir -p .volumes/db .volumes/ch_data .volumes/ch_logs
 # modify command to mount paths
 docker run \
   -p 8080:8080 \