Is it possible to add a static label to logs using a regex capture value?

Grafana Alloy
1

I’d like to know if there’s a way to not repeat myself. I have a folder /var/log/pantheon. Inside that an rsync job will drop log files for multiple Pantheon sites, each under it’s own folder. Within each of those sites is an NGINX log folder and a PHP log folder.

The environment label will be static since this Alloy instance will only process logs for staging. However, I want to make sure each log file is correctly labeled by service. Right now I have a a static label being set by matching the file path.

As you can see, I am repeating the stage.match block several times. One for each service. Is there a better way? Could I do a regex capture from the log file’s path and use that value as the service name?

Alloy potential configuration file (untested):

local.file_match "local_logs" {
    path_targets = [
		{"__path__" = "/var/log/pantheon/**/php/*.log"},
		{"__path__" = "/var/log/pantheon/**/nginx/*.log"},
	]
    sync_period = "500s"
}
loki.process "labels" {

    stage.static_labels {
		values = {
			environment = "staging",
		}
    }

	stage.match {
		selector = "{filename=~\"/var/log/pantheon/service_name_abc/.*\"}"

		stage.static_labels {
			values = {
				service_name = "service_name_abc",
			}
		}
	}

	stage.match {
		selector = "{filename=~\"/var/log/pantheon/another_service/.*\"}"

		stage.static_labels {
			values = {
				service_name = "another_service",
			}
		}
	}

	stage.match {
		selector = "{filename=~\"/var/log/pantheon/xyz_service/.*\"}"

		stage.static_labels {
			values = {
				service_name = "xyz_service",
			}
		}
	}

	stage.match {
		selector = "{filename=~\"/var/log/pantheon/yet_another_one/.*\"}"

		stage.static_labels {
			values = {
				service_name = "yet_another_one",
			}
		}
	}

	forward_to = [loki.write.grafana.receiver]
}
2

You can use a regex group capture (assuming your directory structure is static) and use the captured value as label.

Here is an example, the regex is not what you want, but you should be able to change it to fit your needs: Creating Label with filename value out of filename (Path)