`matches` directive in alloy journald - cannot parse value

Grafana Alloy
1

Hello,

I have an issue with Alloy that I cannot understand. I have the following alloy configuration file:

// For a full configuration reference, see https://grafana.com/docs/alloy
logging {
        level = "warn"
}

loki.relabel "journal" {
  forward_to = []

  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label = "unit"
  }
  rule {
    source_labels = ["__journal__hostname"]
    target_label = "hostname"
  }
}

loki.source.journal "read"  {
        forward_to = [loki.write.endpoint.receiver]
        relabel_rules = loki.relabel.journal.rules
        labels = {component = "loki.source.journal"}
        matches = "netbox.service"
}

loki.write "endpoint" {
  endpoint {
    url ="https://example.com/loki/api/v1/push"
  }
}

But I can’t seem to get the matches directive value right. I keep getting:

level=error msg="failed to evaluate config" controller_path=/ controller_id="" trace_id=8cff8a51e833566a425199d521a61ebe node=loki.source.journal.read err="building component: Error parsing journal reader 'matches' config value"

I’m not sure what it expects here. In the documentation it clearly states that it requires a string, which I’m providing. Could anyone point me to better documentation or just give me a solution to this?

2

I’ve eventually figured it out by looking at an older configuration of promtail. I am not sure why the documentation is so bad and if this is intentional, but this is really discouraging.

This is the only given explanation for matches. It might as well not have existed:

Journal matches to filter. The + character is not supported, only logical AND matches will be added.

For anyone coming across the same issue (which I think is a basic feature, i.e. to choose the logs of an arbitrary systemd service instead of sending all the journald logs!), this is the right syntax:

matches = "_SYSTEMD_UNIT=netbox.service"

I still haven’t figured out how to chain several matches, given the amazingly helpful definition above. Literal AND doesn’t seem to work on various tries.

3

Hi. I’ve opened up the following Issue in the Grafana Alloy repository Docs feedback: loki.source.journal documentation for matches is incomplete and confusing · Issue #1709 · grafana/alloy · GitHub I’ll try to tidy that up when I get to it in my ToDo list.

The docs are being worked on every day. There are a lot of gaps and I’m working on filling them. If you come across any more issues with the docs, please open up an issue and let us know. We will work on improving it :slight_smile: (the gaps in the docs are not intentional)

2 Likes
4

Thanks for the answer. I appreciate it.

I’m guessing you don’t happen to know how I can chain several filters with AND, right? :slight_smile:

5

Ummmm not directly. I’m not 100% sure what you’re asking though.