I’ve got a setup where an application logs locally, those logs are picked up by rsyslog and sent to a promtail instance.
here is the rsyslog config:
module(load="imfile" mode="inotify") input(type="imfile" File="/var/lib/docker/volumes/my_app.log" Tag="my_app" Facility="local4") local4.* @@<IP_of_Promtail>4;RSYSLOG_SyslogProtocol23Format
This works fine, but the “Tag” “my_app” is not processed by promtail, and therefore does not end up in loki.
is explained that I can set
in promtail to parse structured data coming from syslog
Can someone give an example what to write to the rsyslog “Tag” so that it gets parsed?
Simple strings don’t do anything, the entry from the config example
# Whether to convert syslog structured data to labels. # A structured data entry of [example@99999 test="yes"] would become # the label "__syslog_message_sd_example_99999_test" with the value "yes".
also do not get parsed.
what do I exactly enter in the “TAG” field in the rsync imfile module so that promtail parses it to an internal label?