Alloy config for rolling logs with custom labels

Grafana Alloy
1

I would like to setup Grafana alloy to forward logs from a third-party application to my Grafana Loki log server. The application outputs logs in a rolling file format that must be scraped. I would like to add two labels to the log entries scraped: server for the hostname and app for the name of the application. My current alloy setup does forward logs, but not as expected. When I explore logs in Loki, I don’t see the labels I’ve added in the alloy config. Additionally, there are 3 other labels, which I assume alloy scraper adds by default: filename, server, and service_name. Is it possible to remove these labels and have alloy transmit only the labels I want?

Here is my current config:

local.file_match "local_files" {
    path_targets = [{"__path__" = "D:/log/*.log"}]
    sync_period  = "5s"
}

loki.source.file "log_scrape" {
    targets       = local.file_match.local_files.targets
    forward_to    = [loki.process.add_labels.receiver]
    tail_from_end = true
}

loki.process "add_labels" {
    forward_to = [loki.write.grafana_loki.receiver]
    stage.labels {
        values = {
            server = "my-server",
            app    = "my-app",
        }
    }
}

loki.write "grafana_loki" {
    endpoint {
        url = "http://my-log-server:3100/loki/api/v1/push"
    }
}

I took this config from the post add_labels so very confused why it doesn’t seem to work here.

2

Hello benjifuse,

I saw that you referenced my old post. Unfortunately, it seems that I cannot edit it anymore because it is closed, so I answer here.

I would like to let you know that the tags also did not work in my case even though they are part of the config. What was solved, however, is the processing through the whole pipeline which did not work before. But not the tags.

Sorry, that my old config led you down the wrong path. I hope this posts helps to clarify it.

3

Thank you for responding.

I figured out using stage.label_drop to remove the filename label from forwarded logs:

loki.process "remove_labels" {
    forward_to = [loki.write.grafana_loki.receiver]
			
	stage.label_drop {
		values = ["filename"]
	}
}

It seems the detected_level label is being added on the server side via the discover_log_levels in loki’s config.yml, which defaults to true.

For adding static labels to, you can either use the block stage.static_labels in a loki.process component OR you can put them directly in the loki.write component by setting external_tags to the appropriate mapping.

Here’s that portion of my current alloy config:

loki.write "grafana_loki" {
	external_labels = {
		server = "my-server",
		service_name = "my-app",
	}
    endpoint {
        url = "http://my-log-server:3100/loki/api/v1/push"
    }
}