Parsing with stage.cri Fails

Grafana Alloy
1

Given the following logline:

{"log":"2025-03-11T09:38:41.700139662Z stdout F {\"appName\":\"test",\"appVersion\":\"1.23.2\",\"environment\":\"dev\",\"level\":\"info\",\"message\":\"readiness probe succeeded\",\"timestamp\":\"2025-03-11 09:38:41\"}","environment":"dev","cluster_name":"eks-dev"}

I am trying to parse everything and output only the message inside the log field.

    stage.json {
      expressions = { "log" = "log", "environment" = "environment", "cluster_name" = "cluster_name" }
    }

    stage.labels {
      values = { "environment" = "environment", "cluster_name" = "cluster_name" }
    }

    stage.output {
      source = "log"
    }

    stage.cri {}

I thought the above configuration would work but the CRI stage fails with the logs:

ts=2025-03-12T07:36:59.694075856Z level=debug msg="extracted data did not contain output source" component_path=/ component_id=loki.process.logs_process ts=2025-03-12T07:36:59.694127731Z level=debug msg="extracted data did not contain a timestamp" component_path=/ component_id=loki.process.logs_process

I feel like I am making a simple mistake but if anyone has any idea what is wrong I would really appreciate it.

2

What is weird is instead of the cri stage, running the following stages:

    stage.regex {
      expression = "^(?s)(?P<time>\\S+?) (?P<stream>stdout|stderr) (?P<flags>\\S+?) (?P<content>.*)$"
      source = "log"
    }

    stage.output {
      source = "content"
    }

actually does produce the intended behavior. But the regex I am using is the same as in the code for the CRI stage

3

stage.cri is probably still reading from the original logline. I would just use regex.