# Promtail - rewriting output (and using internal labels)

**URL:** <https://community.grafana.com/t/promtail-rewriting-output-and-using-internal-labels/35309>\
**Category:** Grafana Loki\
**Tags:** loki\
**Created:** [August 18, 2020, 4:02pm UTC](https://community.grafana.com/t/promtail-rewriting-output-and-using-internal-labels/35309 "2020-08-18T16:02:30Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![wrightsonm](https://avatars.discourse-cdn.com/v4/letter/w/f9ae1b/32.png) [@wrightsonm](https://community.grafana.com/u/wrightsonm)\
**Post date:** [February 26, 2022, 7:44pm UTC](https://community.grafana.com/t/promtail-rewriting-output-and-using-internal-labels/35309/2 "2022-02-26T19:44:30Z")

</div>

Hi Did you solve this problem?

I have this exact issue and so far I have found a way of retaining information using pack.

i.e.

```auto
- job_name: syslog
  syslog:
    listen_address: 0.0.0.0:1514 # make sure you also expose this port on the container
    idle_timeout: 60s
    label_structured_data: no
    labels:
      job: "syslog"
  relabel_configs:
    - source_labels: ['__syslog_message_hostname']
      target_label: 'host'
      
    - source_labels: ['__syslog_message_app_name']
      target_label: 'app_name'
      
    - source_labels: ['__syslog_message_proc_id']
      target_label: 'proc_id'
      
    - source_labels: ['__syslog_message_msg_id']
      target_label: 'msg_id'
      
    - source_labels: ['__syslog_connection_ip_address']
      target_label: 'ip_address'
      
    - source_labels: ['__syslog_connection_hostname']
      target_label: 'hostname'
      
    - source_labels: ['__syslog_message_severity']
      target_label: 'severity'
      
    - source_labels: ['__syslog_message_facility']
      target_label: 'facility'
  pipeline_stages:
    - match:
        selector: '{job="syslog"}' #match all
        stages:
          - pack:
              labels:
                - proc_id
                - msg_id
                - ip_address
                - hostname
                - severity
                - facility

```

This results in outputs that are in json. format. it also means if the original json then it is json inside json as an escaped string which is not ideal.

Here is an example:

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/2/d/2d74f376f95465bd782c692f6d7a8ff905de6b19.png)

---

_[View the full topic](https://community.grafana.com/t/promtail-rewriting-output-and-using-internal-labels/35309)._