I’m receiving aggregated events in syslog messages.
Each event is separated by the | character.
Is it possible in Alloy to split the syslog message field by the | character into individual events and send them to Loki? I dont care about other syslog fields—PRI, hostname…
I don’t think it’s possible to split logs in Alloy. The only logging agent I am aware of that can do this is logstash, because you need to be able to run scripts with looping logic within the log pipeline.