I’m trying to configure Grafana Alloy to write its own logs to Loki. I have the below config which correctly sets the timestamp and level. How can I remove those 2 parts from the JSON?
I don’t want to parse all fields of the JSON because that would increase cardinality unnecessarily. I’d like to make the log output include the full line, minus the level and ts fields. If logfmt would be easier I’m open to that too.
logging {
level = "debug"
format = "json"
write_to = [loki.process.alloy.receiver]
}
loki.process "alloy" {
forward_to = [loki.write.grafanacloud.receiver]
stage.json {
expressions = {
ts = "",
}
}
stage.timestamp {
source = "ts"
format = "2006-01-02T15:04:05.999999999Z"
}
}
This is how it looks now, rather silly with the timestamp shown twice.
You can use stage.replace to replace strings in the original log with something (like empty string). See loki.process | Grafana Alloy documentation.
My personal preference has always been to not change the log string unless there is a really good reason to. Personally I would advise you to not over-think and not over-engineer unnecessarily. Also in Grafana Explore view I believe there is a toggle to hide timestamp so you don’t see them twice.
You’re right, that can be hidden in grafana. But then you would lose the ability to display in the local time zone.
Also - the “level” label can be displayed more effectively using colors.
Timestamp and level are the 2 things pretty much universal in all types of logs. So my preference would be for these to be labeled separately, and all the rest should be combined in the message.
But I see your point - if I apply some parsing then there could be a risk of accidentally losing some poorly formatted line, which would come at exactly the time when the app has crashed and the logs are needed.
