Convert to json before sending loki

Grafana Alloy
1

i collect my iis logs in the following format with alloy

 2025-02-06 15:05:58 W3SVC88 APPSERVER01 172.20.50.143 GET /Orders/CompleteOrder productId=3 80 - 172.20.50.246 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:134.0)+Gecko/20100101+Firefox/134.0 https://testapp.company.gov.tr/Orders/CompleteOrder testapp.company.gov.tr 200 0 0 594 1041 5

In order to identify which data the space separated fields represent, I label them as follows.

    stage.regex {
        expression = "^(?<date>[^ ]*) (?<time>[^ ]*) (?<s_sitename>[^ ]*) (?<s_computername>[^ ]*) (?<s_ip>[^ ]*) (?<cs_method>[^ ]*) (?<cs_uri_stem>[^ ]*) (?<cs_uri_query>[^ ]*) (?<s_port>[^ ]*) (?<cs_username>[^ ]*) (?<c_ip>[^ ]*) (?<cs_version>[^ ]*) (?<cs_user_agent>[^ ]*) (?<cs_referer>[^ ]*) (?<cs_host>[^ ]*) (?<sc_status>[^ ]*) (?<sc_substatus>[^ ]*) (?<sc_win32_status>[^ ]*) (?<sc_bytes>[^ ]*) (?<cs_bytes>[^ ]*) (?<time_taken>[^ ]*)$"
   }

is there any way to send this data to loki after this moment by converting it to json?

2

I don’t see anything that converts your logs into json, nor do I think it’s possible to do with Alloy (i could be wrong).

I would recommend you to send your logs as is into Loki, then use LogQL to parse. In my opinion it’s much easier that way.