I have been using loki for over a year mainly for scraping tomcat logs. I have been scraping the journal also, but never really paid attention to it.
I was looking at the output of journalctl _UID=1001 -f (this is on a test box for loki and that is the loki user id) and what I could see in the journal logs scraped from the same box by promtail.
I see none of the loki logs in promtail but see all of them using journalctl on the box. What am I doing wrong? Here is my journal scrape config for this box:
scrape_configs:
- job_name: journal
journal:
max_age: 12h
labels:
job: systemd-journal
host: “%{facts.networking.fqdn}”
relabel_configs:
- source_labels:
- ‘__journal__systemd_unit’
target_label: ‘unit’
- source_labels:
- ‘unit’
regex: “session-(.*)”
action: replace
replacement: ‘pam-session’
target_label: ‘unit’
Thanks!