Grafana Alloy | Change detected_level "Fatal" to "Critical" / labels

Grafana Alloy
, ,
1

I’m writing my Apps in .net using Serilog as Logger. Serilog writes the “FATAL” text as loglevel instead of “CRITICAL”.
I’m using Alloy->Loki->Grafana. Everything works great, but since “FATAL” is not known by Alloy, it uses “unknown” as detected_level for my “FATAL” logs.

My logs are quite simple-> loglevel: text
Some examples below:

  • information: Shut down complete
  • fatal: Fatal entry

Is there any way to change this “fatal” to “critical” so the label “critical” would be added as detected_level?
I’ve tried two approaches within the loki.process step:

  • stage.replace to look for “fatal:” using regex and replacing that text to “critical:”
  • stage.labels: keep the text “fatal:” as part of the log but add detected_label = critical as label when the text fatal is found.

Also tried similar approaches but as part of the discovery.relabel, adding rules for changing the unknown to critical when “fatal:” is found as part of the log bug. With all approaches, I always end up with the unknown level as detected_label.
Any help would be appreciated

2

Personally I don’t like altering original log lines, and if you are going to parse for a label and set it to critical you might as well do that for all your logs.

I would recommend you to:

  1. Parse for the log level, se them use the label level
  2. Use a template or something and replace any fatal level with critical.