How to filter logs based on regex under the stage.match of the loki.process

Grafana Configuration
,
1

I try to filter logs using the Alloy and the stage.match using regex.

The log is JSON containing the status field with possible values corresponding to HTTP response codes (200, 302, 400, 502, …).

My configuration

loki.source.file "logs_gitlab_01" {
  targets    = [
    {"__path__" = "/var/log/gitlab/gitlab-rails/production_json.log"},
  ]
  forward_to = [loki.process.logs_gitlab_01.receiver]
}

loki.process "logs_gitlab_01" {

  stage.json {
    expressions = {
      extracted_status = "status",
    }
  }

  stage.labels {
    values = {
      "status" = "extracted_status",
    }
  }

  stage.match {
    selector = "{ `extracted_status=~"2.."`}"

    stage.labels {
      values = {
        "level" = "info",
      }
    }
  }

  forward_to = [loki.process.logs_gitlab_00.receiver]

}

I’ve tried escaping the regex in many way and I receive errors - under reloading configuration -

Failed to build component: building component: invalid stage config invalid selector syntax for match stage: parse error at line 1, col 1: syntax error: unexpected IDENTIFIER, expecting {
The current state of the line with regex is not the only one which I tried.

Yes, I read

Maybe a solution is obvious but I don’t see it. Thank you in advance for any help.

2

If you want to filter logs where status is between 200-299:
stage.match {
selector = {status=~"2[0-9]{2}"}

stage.labels {
values = {
“level” = “info”,
}
}
}
If You Want to Match Only 200 and 302
stage.match {
selector = {status=~"200|302"}

stage.labels {
values = {
“level” = “info”,
}
}
}
Steps to Fix Your Configuration
1.Open your Loki Alloy configuration file
2. Replace your old stage.match block with the correct version

  • Use the 200-299 version or specific status codes based on your need.
  1. Save the file and restart Alloy: systemctl restart alloy
3

Hi!

Thank you for your responce.

After introducing the change and reloading configuration (http:///-/reload) in the log I see

level=error msg="failed to evaluate config" controller_path=/ controller_id="" node=loki.process.logs_gitlab_01 err="building component: invalid stage config invalid selector syntax for match stage: parse error at line 1, col 26: syntax error: unexpected }, expecting = or != or =~ or !~"
interrupt received
4

Try this
make sure selector syntax is correct
image

1 Like
5

Works! Thank you!

1 Like