Hard time to filter only loglines with a certain string

Grafana Alloy
1

I have a logfile with lots of messages, but I only want to forward the lines that got the word “Accepted” (or if possile also “Rejected”) in the logline

This is what I tried, but alloy does not accept it:

loki.process "filter_logs" {
  
  
  stage.match {
    // Valid LogQL: match all streams, then lines that do NOT contain "Accepted"
    selector = "{} !~ \"Accepted\""
    action   = "keep"

    // For lines that matched the selector above, drop them all
    stage.drop {
      expression          = ".*"
      drop_counter_reason = "not_accepted"
    }
  }


  stage.static_labels {
    values = {
      "location" = "greenhouse north",
      "line"   = "carrot",
    }
  }

  forward_to = [loki.write.grafana_loki.receiver]
}

How can I do this without forwarding he whole log to loki and filter in grafana

2

As far as I know stage.match can only match labels, you can’t actually run a query with it. So what I would do is to use stage.regex first and group capture the string, assign said string to a label (and if regex doesn’t find it it’ll be empty anyway), then use that label for matching purpose.

Mock code:

stage.regex {
  expression = `^.*(?P<accepted_flag>Accepted).*`
}

stage.label {
  accepted_flag = "",
}

stage.match {
  selector = "{accepted_flag=\"Accepted\"}"
  ...
}

## Maybe add a drop label for accepted_flag for good measure