LOKI - time format

Grafana Loki
1

I am using following line format

{“host”:“148.139.127.204”, “user-identifier”:“hills1121”, “datetime”:“27/Jan/2024:22:19:53 +0000”, “method”: “PATCH”, “request”: “/repurpose/paradigms/mindshare/empower”, “protocol”:“HTTP/1.0”, “status”:201, “bytes”:27615, “referer”: “http://www.nationalarchitect.io/holistic/extensible”}

In promtail I am having following config:

  • job_name: generated-json-logs
    static_configs:
    • targets:
      • localhost
        labels:
        env: dev6
        job: generated-json-logs
        path: /var/log/generated-json-logs.txt
        pipeline_stages:
    • json:
      expressions:
      http_method: “method”
      http_status: “status”
      http_time: “datetime”
    • labels:
      http_method:
      http_status:
    • timestamp:
      source: http_time
      location: Europe/Warsaw
      format: “02/Jan/2006:15:04:05 +0000”
      action_on_failure: skip

As the result logs are not sent to Loki. I have checked in debug mode that field is successfully extracted

“level=debug ts=2024-01-27T22:24:54.0011047Z caller=json.go:182 component=file_pipeline component=stage type=json msg=“extracted data debug in json stage” extracteddata=“map[env:dev6 filename:/var/log/generated-json-logs.txt http_method:PUT http_status:501 http_time:27/Jan/2024:22:24:52 +0000 job:generated-json-logs]””

I use image mingrammer/flog to generate fake logs in json format.

Do you have any idea why logs are not sent to LOKI?

2

I don’t see anything obviously wrong. Couple of things for you to try:

  1. You seem to believe that logs are being dropped due to time format, why not remove action_on_failure: skip and see if logs are being sent afterwards?

  2. Try running promtail with dryrun, debug, and inspect flags.
    See Troubleshooting Promtail | Grafana Loki documentation