Loki process block leaves log unchanged

Grafana Alloy
1

This is my first time using Grafana. We have another team already using it for other purposes. My team gathers logs using a different client. The goal is to consolidate that functionality into Alloy.

I am using loki.source.windowsevent to gather Windows event logs. It forwards them to an OTLP endpoint. Logs are reaching the OTLP endpoint, but it only parses the json portions of the logs. The message and event_data fields are ignored. I need to either reformat those fields or transform that data into json so the OTLP will see it.

According to the documentation, the stage.eventlogmessage ought to parse the message field. However, it is not changing the log message at all. I feel like I am missing some fundamental truth about Loki, despite re-reading the documentation until crosseyed. Am I missing some sort of command that says “send this new data to the next step?” The stage.output does not apply to my situation because I don’t want to output just one field. Also, stage.labels does not work for me because the OTLP endpoint ignores the attributes fields. With Loki are the labels just a part of the core functionality? Or is there some other stage block that I am missing?

logging {
level = "warn"
}

livedebugging {
  enabled = true
}

loki.source.windowsevent "application"  {
  eventlog_name = "Application"
  forward_to = [loki.process.default.receiver]
}

loki.source.windowsevent "security"  {
  eventlog_name = "Security"
  forward_to = [loki.process.default.receiver]
}

loki.source.windowsevent "system"  {
  eventlog_name = "System"
  forward_to = [loki.process.default.receiver]
}

loki.process "default" {
  forward_to = [otelcol.receiver.loki.default.receiver]
  stage.json {
      expressions = {
          message = "",
          Overwritten = "",
      }
  }
  stage.eventlogmessage {
      source = "message"
      overwrite_existing = true
  }
}

otelcol.receiver.loki "default" {
  output {
    logs = [otelcol.processor.transform.default.input]
  }
}

otelcol.processor.transform "default" {
  error_mode = "ignore"
  log_statements {
    context = "log"
    statements = [
  `merge_maps(body,ParseJSON(body),"upsert") where IsMap(body) and true`,
  `set(body,ParseJSON(body)) where not IsMap(body) and true`,
      `replace_all_patterns(body, "key", "source", "SourceName")`,
      `replace_all_patterns(body, "key", "channel", "Channel")`,
      `replace_all_patterns(body, "key", "computer", "Hostname")`,
      `replace_all_patterns(body, "key", "event_id", "EventID")`,
      `replace_all_patterns(body, "key", "level", "Level")`,
      `replace_all_patterns(body, "key", "task", "Task")`,
      `replace_all_patterns(body, "key", "levelText", "EventLevelName")`,
      `replace_all_patterns(body, "key", "opCodeText", "Opcode")`,
      `replace_all_patterns(body, "key", "keywords", "Keywords")`,
      `replace_all_patterns(body, "key", "timeCreated", "TimeCreated")`,
      `replace_all_patterns(body, "key", "eventRecordID", "RecordNumber")`,
    ]
  }
  output {
    logs = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.exporter.otlp "default" {
    client {
        endpoint = "10.10.10.10:4317"
        tls {
            insecure             = true
            insecure_skip_verify = true
        }
    }
}