Hello. I’m using promtail to collect logs and send them to loki. But at the moment there is a requirement to collect gitlab audit logs into custom audit service with HTTP API. I tried to push logs directly from promtail to the service but received protobuf request body which I cannot parse. Is there a way to configure promtail to send data in json format?
I can periodically pull logs from loki, but it will be less convenient and probably less reliable.
I don’t think this can be done in promtail. You could probably use template to form a JSON string if you really try, but it’d probably be rather messy and potentially not very reliable.
You might consider using other solutions that are more flexible such as fluentd instead of promtail, or you could, as you already pointed out in your original post, pull from Loki and send to your audit service periodically.
It depends what that HTTP API expects. But I would try to use opentelemetry collector (you can remove promtail part completely eventually or use loki receiver) and use syslog/otlphttp (with plain json encoding, not protobuf) exporter.