Map File for stage.match in loki.process

Grafana Alloy
1

I am using loki.source.syslog to process syslogs from various targets. I want to add custom labels based on the ip_address that is passed in the syslog. I have successfully pulled out the ip_address from the log and used loki.process with stage.match and stage.static_labels to assign the custom labels.

loki.process “syslog_add_labels” {

stage.match {
selector = “{sourceip="10.0.0.0"}”
stage.static_labels {
values = {
“location” = “test1”,
“environment” = “test2”,
“application” = “findme”,
}
}
}

stage.match {
selector = “{sourceip="9.2.3.4.5"}”
stage.static_labels {
values = {
“location” = “chicago”,
“environment” = “production”,
“application” = “app1”,
}
}
}

stage.match {
selector = “{sourceip="4.5.6.7.8"}”
stage.static_labels {
values = {
“location” = “indianapolis”,
“environment” = “development”,
“application” = “app2”,
}
}
}
forward_to = [loki.write.grafana_cloud_loki.receiver]
}

As I add more targets, I need to deploy a new river file each time. Is there a way to use a file to lists the map? That way I only need to deploy a new file and the river will pick up the changes.

2

Ideally the labels should come from the source (part of the log messages), it’s unreasonable to expect log agent (alloy) to have context on its upstream.

But if you can’t do that, using Alloy modules might be a way around this. You can include the module from your main alloy configuration, use the module to process the label, and in future deployment you’d just need to change the module file. See Modules | Grafana Alloy documentation and Custom components | Grafana Alloy documentation.