Scrape journald log with Alloy docker container

Grafana Configuration
1

I want to scrape the host journald log with Alloy running in a docker container. But nothing is read or sent.

Here is the config.alloy

loki.relabel "journal" {
  forward_to = []

  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label  = "systemd_unit"
  }
  rule {
    source_labels = ["__journal__hostname"]
    target_label = "systemd_hostname"
  }
  rule {
    source_labels = ["__journal__transport"]
    target_label = "systemd_transport"
  }
}

loki.source.journal "read"  {
  forward_to    = [loki.write.grafanacloud.receiver]
  relabel_rules = loki.relabel.journal.rules
  max_age       = "12h"
  labels        = {component = "loki.source.journal"}
}

loki.write "grafanacloud" {
  endpoint {
    url = "https://logs-prod-007.grafana.net/loki/api/v1/push"

    basic_auth {
      username = "*****"
      password = "glc_*****"
    }
  }
}

And the command to start the Alloy container:

sudo docker run -d --restart=unless-stopped --name=grafana-alloy \
-v /etc/alloy:/etc/alloy \
-v /run/log:/run/log \
-v /var/log:/var/log \
grafana/alloy:latest \
run --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy

I use the same Alloy configuration on another system with Alloy installed by apt, and it works without issue.

The debug panel shows green for all components. I also exec into the Alloy container and checked that the logs in /var/log and /run/log are readable.

What could be the problem?

2

I was running into the same issue and dug into the code, it turns out that in the current version of alloy (v1.1.0), you need to explicitly set the path value for the loki.source.journal component when running within a Docker container.

loki.source.journal "read"  {
  forward_to    = [loki.write.grafanacloud.receiver]
  relabel_rules = loki.relabel.journal.rules
  max_age       = "12h"
  path          = "/var/log/journal"
  labels        = {component = "loki.source.journal"}
}

It is due to the way that it is implemented currently. I opened a ticket with the project here so hopefully they can fix this either in the documentation or the code moving forward.

Hope this helps!

1 Like