I’m migrating from promtail to alloy and trying to get the same output from alloy.
My promtail config.yaml has a pipeline stage that enriches the Loki telemetry with the process-id and sudo information. As I understand it, it pulls this information out of the log message (using regex) and assigns it to its own label.
See below:
# ..rest of file
scrape_configs:
- job_name: system
static_configs:
- targets:
- 127.0.0.1 #hidden for forum
labels:
job: syslogs
host: ${HOSTNAME}
dc: ${DC}
__path__: /var/log/{syslog,auth.log}
pipeline_stages:
- match:
selector: '{filename="/var/log/syslog"}'
stages:
- regex:
expression: '(?P<procname>\S+?)(?P<pid>\[\d+\]:?)'
- labels:
procname:
- match:
selector: '{filename="/var/log/auth.log"}'
stages:
- regex:
expression: '(?P<procname>\S+?)(?P<pid>\[\d+\]:?)'
- labels:
procname:
- match:
selector: '{filename="/var/log/auth.log"}'
stages:
- regex:
expression: '(?P<sudo>sudo:?): .* ; COMMAND='
- labels:
sudo:
I tried to use the migration tool discussed in the migrate from protail docs and it generated the alloy blocks below. I do not think this will work as it seems to be populating the labels with null data which is not what promtail is doing
//rest of file
loki.process "system" {
forward_to = [loki.write.default.receiver]
stage.match {
selector = "{filename=\"/var/log/syslog\"}"
stage.regex {
expression = "(?P<procname>\\S+?)(?P<pid>\\[\\d+\\]:?)"
}
stage.labels {
values = {
procname = null,
}
}
}
stage.match {
selector = "{filename=\"/var/log/auth.log\"}"
stage.regex {
expression = "(?P<procname>\\S+?)(?P<pid>\\[\\d+\\]:?)"
}
stage.labels {
values = {
procname = null,
}
}
}
stage.match {
selector = "{filename=\"/var/log/auth.log\"}"
stage.regex {
expression = "(?P<sudo>sudo:?): .* ; COMMAND="
}
stage.labels {
values = {
sudo = null,
}
}
}
}
I tried to use a loki.relabel block in my own implementation, but that also didn’t work. See my implementation below:
//.. initial alloy blocks
loki.relabel "unix_log_files_syslog" {
forward_to = [loki.relabel.unix_log_files_label_cleaner.receiver]
rule {
action = "replace"
regex = "(?P<procname>\\S+?)(?P<pid>\\[\\d+\\]:?)"
replacement = "${procname}"
target_label = "procname"
}
}
loki.relabel "unix_log_files_auth" {
forward_to = [loki.relabel.unix_log_files_label_cleaner.receiver]
rule {
action = "replace"
regex = "(?P<procname>\\S+?)(?P<pid>\\[\\d+\\]:?)"
replacement = "${procname}"
target_label = "procname"
}
rule {
action = "replace"
regex = "(?P<sudo>sudo:?): .* ; COMMAND="
replacement = "${sudo}"
target_label = "sudo"
}
}
//.. furture alloy code
What am I doing wrong? Please assist if possible 
