Is it possible to use value extracted from one log line as a label for another set log lines?

Grafana Alloy
1

I am relatively new to grafana-alloy. I am using alloy to scrape logs from a local file and send them to loki.
I have a use-case where I need to extract some id from a log line and use it as label for subesquent log lines.
For example:
I have log file that looks this

my deployment id is 1743571222_192_170_8_4
my deployment version is 1.1
my deployment codeline is <some-code-line>
....
....

I want to extract value 1743571222_192_170_8_4 from first line and add it as label(like deployid=1743571222_192_170_8_4) to the subsequent log lines.

So far I am using the config file looks something like this,

logging {
  level  = "debug"
}

local.file_match "deploy_logs" {
  path_targets = [
    {__path__ = "deploylog.*"},
  ]
}

loki.source.file "deploylog_scrape" {
	targets = local.file_match.deploy_logs.targets
	forward_to = [loki.process.add_deployid_label.receiver]
	tail_from_end = true
}


loki.process "add_deployid_label" {
  forward_to = [loki.process.filter_logs.receiver]

  // Stage to parse log lines and extract deployid
  stage.regex {
    expression = ".*my deployment id is (?P<deployid>\\S+).*"
  }

  // Stage to add the deployid label
  stage.labels {
    values = { "deployid" = "deployid" }
  }
}

loki.process "filter_logs" {
    forward_to = [loki.write.local.receiver]
}

loki.write "local" {
  endpoint {
    // endpoint config
  }
}

But this only adds label to the line matching the regex. Is it possible to do using alloy?

2

I don’t think that’s possible.

If you have multiple lines that should be considered as one unit, and if you have a clear way to discern the starting point of those lines, perhaps consider using multiline and just group them into one log?

3

Thanks for the reply!
But I don’t think grouping the logs would be feasible in my case, as the log lines would be too much(~1k to 2k).