Grafana Agent Flow - Get Label from Part of File Path

Grafana Alloy
1

Please help me get a label from part of the file path using Grafana Agent Flow.

This is my non-working, feeble attempt:

local.file_match "xrc_sitechecker_xrc_eventlogs" {
  path_targets = [
    {__path__    = "/Users/1/Documents/3/Event Logs/Exported Event Logs/012/Event Logs/*.csv", "sitename" = "mysite", job = "eventlogs", "radiosystem" = "system1"},
  ]
}

loki.process "xrc_sitechecker_xrc_eventlogs" {
   forward_to = [loki.write.local.receiver]

   stage.regex {
      source_labels = ["__path__"]
      regex         = ".*/(?<site>[0-9]+)/Event Logs/.*\\.csv"
   }
1 Like
2

I’ll be working on the same thing the coming days. Did you end up finding ? If not, I’ll search/try and will share if I get anywhere with it.

3

Finally working on this bit and I’m struggling a bit with it.
@Danfoxley, Did you end up finding something ?

4

Ok I found what worked for me. Maybe there are other ways to do it.
I realized Grafana Agent was capturing the “filename”, which is the full file path.

From there, it comes down to doing a “relabel”, to copy the value of Filename, then apply a regex to capture a group and finally set that captured group as the new value.
For me, logs are in: c:\logspath\customer00\app00\logfile.log

loki.relabel "dynamic_labels" {
    forward_to = [loki.relabel.fixed_labels.receiver] 

    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "customer"
        regex           = `c:\\logspath\\(?P<customer>.*)\\.*\\.*`
        replacement     = "$1"
    }
    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "app"
        regex           = `c:\\logspath\\.*\\(?P<app>.*)\\.*`
        replacement     = "$1"
    }
//////////// Trying to figure how to either concatenate two selection groups OR to exclude something from selection group
//////////// Thinking about names like "ErrorLog_03072024.txt", so it becomes "errorlog.txt"
    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "filename"
        regex           = `c:\\ems\\logspath\\.*\\.*\\(?P<filename>.*)`
        replacement     = "$1"
    }
}

As you see the comment in my config, I still need to figure something about the filename rule…
But at least I have my customer and app labels working. :slight_smile:

I hope that helps someone.

1 Like
5

@damienchristelbach
(Replies from Grafana community were buried in an old email)

I never sorted it out, I hard coded EACH with this:

local.file_match "rc_sitechecker_rc_eventlogs" {
     path_targets = [
        {__path__    = "/Users/user/Documents/Event Logs/Exported Event Logs/001/Event Logs/*.csv", "sitename" = "TempSite", job = "rc_eventlogs", "radiosystem" = "system45", "siteid" = "1"},

      .....  repeat for each __path__
6

Sorry I also missed your reply, by a couple months… Shame on me.

local.file_match "rc_sitechecker_rc_eventlogs" {
     path_targets = [
        {__path__    = "/Users/user/Documents/Event Logs/Exported Event Logs/001/Event Logs/*.csv", "sitename" = "TempSite", job = "rc_eventlogs", "radiosystem" = "system45", "siteid" = "1"},

      .....  repeat for each __path__

Did you try repurposing the relabel block I posted above ?
For you it would likely look like this:

loki.relabel "path_to_labels" {
    forward_to = [loki.Whatever_Next_Step.receiver] 

    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "job"
        regex           = `c:\\Users\\user\\Documents\\Event\ Logs\\(?P<job>.*)\\.*`
        replacement     = "$1"
    }
    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "siteid"
        regex           = `c:\\Users\\user\\Documents\\Event\ Logs\\.*\\(?P<siteid>.*)\\.*\\.*`
        replacement     = "$1"
    }

And then you forward that to a block that statically assigns what looks like static labels:
“sitename” = “TempSite”
“radiosystem” = “system45”

(i’m probably too late to be helpful but that’s how I’d do it anyways)

1 Like