Multiline and regex

Grafana Loki
1

Im trying to extract subject as label from mailbox file.
Whatever the order between regex and multiline, i never succeed to extract the subject or at least to send it to loki from promtail
I checked regex on regexp101 with go regexp and it’s working fine.

My block is the following :

- job_name: crontab
  pipeline_stages: 
    - regex: 
        expression: "^Subject: (?P<subject>.+)
    - multiline: 
        firstline: "From foobar@"
        maxline: 200 
 static_configs: 
    labels: 
       subject: subject

I dont know what im doing wrong, but subject is never appearing in graphana, instead i have “subject subject”

Can you help ?

2

Hey @dpac

I think you have a missing quote here:

- job_name: crontab
  pipeline_stages: 
    - regex: 
        expression: "^Subject: (?P<subject>.+)" # <--- add this quote
3

sorry it’s me i did not write here with ending quite.
So whatever the char used simple or double quote, it’s not working.
Without any quotes promtail is failing to start

4

The reason why your “subject” label is always showing “subject” is because you’ve put it in static_configs. You should move that labels stage into pipeline_stages after the regex stage.

5

do you have an explicit solution ?
cause currently if i move labels into pipeline_stage promtail is unable to parse the config file

6

When reporting errors, a little detail goes a long way.

cause currently if i move labels into pipeline_stage promtail is unable to parse the config file

Can you please show the exact config file and error you’re receiving?

7

well you ask me to put it into the pipeline_stage, so i assume you know exactly the syntax and the semantic of it. Could you provide a solution based on my peace of conf in the first post. thank

8 
- job_name: crontab
  pipeline_stages: 
    - regex: 
        expression: "^Subject: (?P<subject>.+)
    - labels: 
       subject: subject
    - multiline: 
        firstline: "From foobar@"
        maxline: 200
9

so i dont put it after multiline then ?

Thank you it works

10

I don’t think the ordering matters, as multiline has nothing to do with your regexp stage.

Glad this worked for you! Please mark the question and solved.

11

Well in fact it’s not working as expected, when the message is short enough, subject is sent to loki. But when the message is long enough it goes through multiline and the subject is not sent.

12

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.