Grafana Agent Flow - Get Label from Part of File Path

Please help me get a label from part of the file path using Grafana Agent Flow.

This is my non-working, feeble attempt:

local.file_match "xrc_sitechecker_xrc_eventlogs" {
  path_targets = [
    {__path__    = "/Users/1/Documents/3/Event Logs/Exported Event Logs/012/Event Logs/*.csv", "sitename" = "mysite", job = "eventlogs", "radiosystem" = "system1"},
  ]
}

loki.process "xrc_sitechecker_xrc_eventlogs" {
   forward_to = [loki.write.local.receiver]

   stage.regex {
      source_labels = ["__path__"]
      regex         = ".*/(?<site>[0-9]+)/Event Logs/.*\\.csv"
   }


1 Like

I’ll be working on the same thing the coming days. Did you end up finding ? If not, I’ll search/try and will share if I get anywhere with it.

Finally working on this bit and I’m struggling a bit with it.
@Danfoxley, Did you end up finding something ?

Ok I found what worked for me. Maybe there are other ways to do it.
I realized Grafana Agent was capturing the “filename”, which is the full file path.

From there, it comes down to doing a “relabel”, to copy the value of Filename, then apply a regex to capture a group and finally set that captured group as the new value.
For me, logs are in: c:\logspath\customer00\app00\logfile.log

loki.relabel "dynamic_labels" {
    forward_to = [loki.relabel.fixed_labels.receiver] 

    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "customer"
        regex           = `c:\\logspath\\(?P<customer>.*)\\.*\\.*`
        replacement     = "$1"
    }
    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "app"
        regex           = `c:\\logspath\\.*\\(?P<app>.*)\\.*`
        replacement     = "$1"
    }
//////////// Trying to figure how to either concatenate two selection groups OR to exclude something from selection group
//////////// Thinking about names like "ErrorLog_03072024.txt", so it becomes "errorlog.txt"
    rule {
        action          = "replace"
        source_labels   = ["filename"]
        target_label    = "filename"
        regex           = `c:\\ems\\logspath\\.*\\.*\\(?P<filename>.*)`
        replacement     = "$1"
    }
}

As you see the comment in my config, I still need to figure something about the filename rule…
But at least I have my customer and app labels working. :slight_smile:

I hope that helps someone.

1 Like