Any limit in promtail's config file to detect/generate labels via regex on logs?

Hello team:
My original promtail.yaml file is currently tailored to parse 5 (five) pieces of information in each log message in order to generate their associated labels for Loki. I do this in the “scrape-configs” section using the “pipeline_stages/regex” facility.

I was asked to detect a new, 6th piece of information in the messages in order to generate its corresponding label. I modified the regex expression but promtail fails to restart :o(

I am pretty sure that the modified regex expression is syntactically correct (in fact; I checked it with success in a regex validator tool).

Is there any limit regarding the pieces of information I can parse within a log?

Your hints will be greatly appreciated
Best regards

Rogelio

There probably is a theoretical limit, but certainly would be a number greater than 6.

Can you post your configuration? Also, you can run promtail in inspect mode for troubleshooting purpose (see Troubleshooting Promtail | Grafana Loki documentation).

Hello Tony, nice to meet you.

I attached two images. One is the working (former) configuration. The other is the one that tries to detect a 6th field and associate its corresponding label.

I will follow your advice and run in debug mode to see if I can get some feedback from Promtail. Thanks!

Tony;
I followed your advice and found something. I ran the following command and I got the following error:

root@12b83a03e520:/etc/promtail# promtail -config.file=docker-config.yaml -check-syntax
Unable to parse config: docker-config.yaml: yaml: line 46: found character that cannot start any token. Use -config.expand-env=true flag if you want to expand environment variables in your config file

Line 46 is the definition of my new label, called “model”. It is the last line in my YAML. I will see if I can dig into this error message.

Thanks!

Problem solved!!!

I used tabs between the left margin in my new label. It seems that promtail´s YAML does not accepts tabs!! As soon as I replaced the tabs with as many space characters as needed, the problem dissapeared.

Like the song says: “… everybody plays the fool sometimes…” :smiley:

I found TONs of people that got into this issue. It is funny to see the following thread of comments to feel better and realize I am not the only fool in the earth :smiley:

Thanks!!!

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.