Loki Log Export Format OpenHab

Hi,
I’ve just implemented Grafana, Loki and PromTail to extract logs from my OpenHab home automation setup.
For this particular log If I have an entry of:

2022-04-13 12:00:27.274 [INFO ] [.openhab.core.model.script.speedtest] - --> speedtest output:
{"type":"result","timestamp":"2022-04-13T11:00:27Z","ping":{"jitter":3.5489999999999999,"latency":8.7349999999999994},"download":{"bandwidth":25240775,"bytes":371787244,"elapsed":15010},"upload":{"bandwidth":2622651,"bytes":20608200,"elapsed":7904},"packetLoss":0,"isp":"Virgin Media","interface":{"internalIp":"192.168.0.12","name":"eth0","macAddr":"AA:BB:CC:DD:EE:FF","isVpn":false,"externalIp":"86.4.170.46"},"server":{"id":3504,"host":"speedtest.tnp.net.uk","port":8080,"name":"TNP Ltd.","location":"Manchester","country":"United Kingdom","ip":"11.22.333.444"},"result":{"id":"c29cb8fe-6444-45c7-a564-82e9020c7f9a","url":"https://www.speedtest.net/result/c/c29cb8fe-6444-45a1-a123-aaaaaaaa","persisted":true}}

Using this regex expression:

^(?P<time>.+) \[(?P<level>[a-zA-Z]+) ?\] \[(?P<component>[a-zA-Z \.]+)\] - (?P<output>.+)$

On regex101: build, test, and debug regex I can see the expression is correctly split:
image

However, in Grafana I see:

Thanks,
Richie

Having to split post as limited to two screenshots per post :frowning:
It looks like the log entry is not being split correctly, although some other entries seem to be formatted correctly:
image

Also, I never get the “ERROR” level being an option to select (there are ERROR entries showing in the log). Also you can see by the colour bar on the left of each entry that it knows whether it’s INFO, WARN, ERROR:
image

Part 3:

under “level” there is no “ERROR” value
image

I’m seeing other logs formatting correctly.

Part of my promtail yaml file:

- job_name: openhab-system

  pipeline_stages:
    - multiline:
        firstline: '^(?P<time>.+) \[(?P<level>[a-zA-Z]+) ?\] \[(?P<component>[a-zA-Z \.]+)\] - (?P<output>.+)$'
        max_wait_time: 1s
    - regex:
        expression: '^(?P<time>.+) \[(?P<level>[a-zA-Z]+) ?\] \[(?P<component>[a-zA-Z \.]+)\] - (?P<output>.+)$'
    - labels:
        level:
        component:
    - timestamp:
        format: "2021-06-22 15:04:03.828"
        source: time
    - output:
        source: output

  static_configs:
  - targets:
      - localhost

    labels:
      job: openhab-system
      __path__: /var/log/openhab/openhab.log

Can anyone give me some pointers on where I’m probably going wrong?

Thanks,
Richie