Parsing "Tags/Structured_Data" Field from rsyslog in Promtail

[eugenkrieger]

Hi,
I’ve got a setup where an application logs locally, those logs are picked up by rsyslog and sent to a promtail instance.

here is the rsyslog config:

module(load="imfile" mode="inotify")

input(type="imfile"
      File="/var/lib/docker/volumes/my_app.log"
      Tag="my_app"
      Facility="local4")

local4.* @@<IP_of_Promtail>4;RSYSLOG_SyslogProtocol23Format

This works fine, but the “Tag” “my_app” is not processed by promtail, and therefore does not end up in loki.

Here:

Scraping | Grafana Loki documentation

is explained that I can set

label_structured_data: true

in promtail to parse structured data coming from syslog

Can someone give an example what to write to the rsyslog “Tag” so that it gets parsed?
Simple strings don’t do anything, the entry from the config example

# Whether to convert syslog structured data to labels.
# A structured data entry of [example@99999 test="yes"] would become
# the label "__syslog_message_sd_example_99999_test" with the value "yes".

also do not get parsed.

what do I exactly enter in the “TAG” field in the rsync imfile module so that promtail parses it to an internal label?

[eugenkrieger]

The Tag from rsyslog is set, not as “tag” but as “app_name” , so it can be relabeled in promtail as follows:

Relabel_configs:
       - source_labels: ['__syslog_message_app_name']
         target_label: 'syslog_tag'