How template works unstructured log line

Grafana Alloy
1

I have a log line that I have grouped as follows

    stage.regex {
        expression = `^(?P<date>[^ ]*) (?P<time>[^ ]*) (?P<site>[^ ]*) (?P<computer>[^ ]*) (?P<serverip>[^ ]*) (?P<method>[^ ]*) (?P<path>[^ ]*) (?P<query>[^ ]*) (?P<port>[^ ]*) (?P<username>[^ ]*) (?P<ip>[^ ]*) (?P<version>[^ ]*) (?P<agent>[^ ]*) (?P<referer>[^ ]*) (?P<host>[^ ]*) (?P<status>[^ ]*) (?P<substatus>[^ ]*) (?P<win32_status>[^ ]*) (?P<request_bytes>[^ ]*) (?P<response_bytes>[^ ]*) (?P<duration>\d+)\r?$`
    }

for example, I want to convert the “site” field here to lowercase with ToLower

	stage.template {
		source = "site"
		template = "{{ .site | ToLower }}"
    }

it doesn’t work when I do it this way

I can see that when I give a different name as source (for example lowered_site) and add it as a label, it converts it to lowercase. How can I make it do this on the original logline? or if I want to add it as a new field at the end of the original logline?

2

If you want to change the original log line you’d want to use stage.replace with an empty source field, see loki.process | Grafana Alloy documentation

3

Templates in unstructured log lines help standardize and extract meaningful data from raw logs. They define patterns that allow systems to parse and categorize different log entries, making it easier to analyze and troubleshoot.