Hello, we want to replace es with Loki. The previous architecture is filebeat, Kafka, logstash, es. We have made the following changes:
- Logstash install the output Loki plug-in
- In logstash, change output to
` filter {
mutate {
add_field => {
“application” => “kpi-%{app_name}”
}
}
}
output {
loki {
url => "http://loki-distributed-gateway.loki.svc.cluster.local/loki/api/v1/push"
tenant_id => "%{application}"
batch_wait => 1
retries => 3
}`
- I want to use filter application field as tenant id, but it doesn’t work.