Forwarding journald logs to loki with structured metadata

Grafana Alloy
1

I’m trying to feed Loki with journal logs. Minimal working config works kinda ok, but it drops all the important metadata and basicaly drops everything besides the log message itself.

loki.source.journal "journal" {
  forward_to = [loki.write.default.receiver]
}
loki.write "default" {
  endpoint {
    url = "http://…/loki/api/v1/push"
  }
}

Docs states that, those fields are loaded into the

All messages read from the journal include internal labels following the pattern of __journal_FIELDNAME and Alloy drops them before sending to the list of receivers specified in forward_to.

With labelmap rule I’m able to pass this data, but it then lands in “indexed labels”, while I would like to keep them in “structured metadata”.

loki.relabel "journal" {
  forward_to = []
  rule {
    action = "labelmap"
    regex = "__(.*)"
  }
}

Is it somehow possible to have journald logs feed into the loki, with message as message and all other things in “structured metadata” instead of “indexed labels”?

2

loki.processhas stage.structured_metadata which moves labels into structured metadata, and can take a regex.

You still need to relabel them to remove the __ prefix in a previous step else they don’t even make it to the loki.process stage.