I am trying to use Loki to read syslog messages of an Alcatel switch we have in the Grafana Explore tab. I already did the necessary configurations on the switch device.
In order to test if my switch device is sending the logs, I installed a Kiwi Syslog server and it shows these log messages opened on Port 1514:
I am using this promtail-config file:
server:
http_listen_port: 9080
grpc_listen_port: 0
positions:
filename: C:\loki\positions.yaml
clients:
- url: http://localhost:3100/loki/api/v1/push
scrape_configs:
- job_name: windowsApplication
windows_events:
use_incoming_timestamp: false
bookmark_path: "./bookmark_application.xml"
eventlog_name: "Application"
xpath_query: '*'
labels:
job: windowsApplication
relabel_configs:
- source_labels: ['computer']
target_label: 'host'
- job_name: windowsSecurity
windows_events:
use_incoming_timestamp: false
bookmark_path: "./bookmark_security.xml"
eventlog_name: "Security"
xpath_query: '*'
labels:
job: windowsSecurity
relabel_configs:
- source_labels: ['computer']
target_label: 'host'
- job_name: windowsSystem
windows_events:
use_incoming_timestamp: false
bookmark_path: "./bookmark_system.xml"
eventlog_name: "System"
xpath_query: '*'
labels:
job: windowsSystem
relabel_configs:
- source_labels: ['computer']
target_label: 'host'
- job_name: windowsSetup
windows_events:
use_incoming_timestamp: false
bookmark_path: "./bookmark_setup.xml"
eventlog_name: "Setup"
xpath_query: '*'
labels:
job: windowsSetup
relabel_configs:
- source_labels: ['computer']
target_label: 'host'
- job_name: syslog
syslog:
listen_address: 0.0.0.0:1514
idle_timeout: 60s
label_structured_data: yes
labels:
job: "syslog"
relabel_configs:
- source_labels: ['__syslog_message_hostname']
target_label: 'host'
- source_labels: ['__syslog_message_app_name']
target_label: 'app'
The Windows Events Jobs are found within the explore tab but no syslog logs.
I also recieve this message when I run promtail from the command line:
“level=info ts=2024-07-16T09:19:49.885913Z caller=transport.go:186 msg=“syslog listening on address” address=[::]:1514 protocol=tcp tls=false”.
Where could the issue be?