How to Map Log Attributes to Loki Label Filters with Grafana Alloy?

Grafana Alloy
1

I am using the OpenTelemetry library in my .NET application to collect logs, which are sent to Grafana Alloy. Grafana Alloy then forwards these logs to Grafana Loki.

I need help mapping specific log attributes (e.g., service.name, environment, or other custom attributes) to Loki label filters. How can I configure Grafana Alloy to achieve this?

Any guidance or examples would be greatly appreciated. Thank you!

image
image624×295 52.8 KB

image
image624×265 31.3 KB

Configuration

otelcol.receiver.otlp “otlp_receiver” {
grpc {
endpoint = “0.0.0.0:4317”
}
http {
endpoint = “0.0.0.0:4318”
}

output {
metrics = [otelcol.exporter.prometheus.default.input]
logs = [otelcol.exporter.loki.default.input]
traces = [otelcol.processor.batch.example.input]
}
}

otelcol.exporter.prometheus “default” {
forward_to = [prometheus.remote_write.default.receiver]
}

otelcol.exporter.loki “default” {
forward_to = [loki.write.default.receiver]
}

loki.write “default” {
endpoint {
url = “http://loki:3100/loki/api/v1/push”
}
}

otelcol.processor.batch “example” {
output {
traces = [otelcol.exporter.otlp.default.input]
}
}

otelcol.exporter.otlp “default” {
client {
endpoint = “tempo:4317”
tls {
insecure = true
insecure_skip_verify = true
}
}
}

prometheus.remote_write “default” {
endpoint {
url = “http://mimir:9009/api/v1/push”
}
}

2

Looks like nested JSON? Try this (not tested):

loki.write “default” {
  endpoint {
    url = “http://loki:3100/loki/api/v1/push”
  }
}

loki.process "local" {
  forward_to = [loki.write.“default”.receiver]

  stage.json {
    expressions = {
      attributes = "",
    }
  }

  stage.json {
    source      = "attributes"
    expressions = {
      ConnectionId = "",
      Method       = "",
    }
  }

  stage.labels {
    values = {
      connection_id = "ConnectionId",
      method        = "Method",
    }
  }
}

And change your otelcol loki exporter to:

otelcol.exporter.loki “default” {
  forward_to = [loki.process.local.receiver]
}

I only included two labels as examples (ConnectionId and Method), but you can add more. Just be sure to exercise caution and keep in mind the best practices on limiting potential values for labels.

1 Like
3

Thank you for your guidance; I truly appreciate it. Could you please provide instructions on handling logs where the attributes are dynamic and not fixed?

4

I am pretty sure if a key doesn’t exist it would be assigned null value, which when sent to Loki would simply not exist as a label. I’d recommend you to test it out.

1 Like
5

Are you suggesting that all potential attributes should be specified in the Alloy configuration?

6

No, I do not suggest you to turn all potential attributes into labels. Only pick the ones you need. See Loki’s label best practices here: Label best practices | Grafana Loki documentation

1 Like
7

Thank you for your suggestion; it means a lot. Is there a way to convert all attributes into Loki labels?

8

I don’t believe there is a way to dynamically do it. I haven’t had to do this, since it’s generally a bad idea because you do want to limit on number of labels and their potential values.

1 Like
9

I think a better approach would be to use: ‘otelcol.processor.attributes’ with key=”loki.attribute.labels”.
Best check this example: otelcol.exporter.loki | Grafana Agent documentation

10

The question was for alloy. The doc you point to is grafana agent

11

My bad I put the wrong link: otelcol.exporter.loki | Grafana Alloy documentation
I just did it for Alloy.