New to Alloy, trying to drop Apache httpd lines with status 200

Grafana Alloy
1

Hi folks, hoping someone can tell me what I’m doing wrong here. I’m still getting lines over to Loki with http status 200.

Thanks!

Adam

Alloy 1.10.0

Example line from Apache log
192.168.1.7 1758915904 - - [26/Sep/2025:14:45:04 -0500] GET /some/url?param=foobar HTTP/1.1 500 354 22/2

local.file_match “httpd” {
path_targets = [
{
address = “localhost”,
path = “/tmp/test_response_log”,
job = “TEST_response_httpd”,
host = “myhost.com”,
},
]
}

loki.source.file “httpd” {
targets = local.file_match.httpd.targets
forward_to = [loki.process.httpd.receiver]
tail_from_end = true
}

loki.process “httpd” {
forward_to = [loki.write.default.receiver]

stage.regex {
// LogFormat “%h %{%s}t %l %u %t "%r" %>s %b %T/%D”
expression = “^(?<client_ip>\S+)\s+(?\d+)\s+(?\S+)\s+(?\S+)\s+\[(?[^\]]+)\]\s+\"(?[^\"]+)\"\s+(?\d+)\s+(?\S+)\s+(?\d+)\/(?\d+)$”
}

//
// We want status != 200 only - We want errors
//
stage.drop {
source = “status”
value = “200”
}
}

loki.write “default” {
endpoint { url = “http://lokihost:3100/loki/api/v1/push” }
}

2
  1. In Alloy if you use double quote for your regex expression you need to double escape special characters. Otherwise you should using ` instead of " to enclose the regex expression.
  2. You have several group capture with question mark but not a name.
  3. I see your regex expression has double quotes, but your example log message does not. Is that a mismatch?
3

Thanks for the response Tony - Something’s not copy / pasting right in my expression, I’ll see if I can fix it.