Systemd log priority levels in Alloy

Grafana Alloy
1

When pushing logs from journald to Loki, I can’t get the priority levels (info, error, warning etc.) quite right. Do you guys and gals have any idea what I could do differently here? My Alloy config is as follows:

loki.relabel "journal" {
  forward_to = []

  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label  = "unit"
  }

  rule {
    source_labels = ["__journal__systemd_priority"]
    target_label  = "level"
  }
}

loki.source.journal "read" {
  forward_to    = [loki.write.endpoint.receiver]
  relabel_rules = loki.relabel.journal.rules
  labels        = {
    component = "loki.source.journal",
    host = "<hostname>",
  }
}

loki.write "endpoint" {
  endpoint {
    url = "http://<loki_ip>:3100/loki/api/v1/push"
    tenant_id = "infra"
  }
}

The script I’m interested in inspecting logs from:

rsync -av /media/assets /media/backup | sed 's/^/<7>/'
test 0 -eq ${PIPESTATUS[0]} \
  && echo "<5>Finished copying Assets." \
  || echo "<3>An error occured while copying Assets." >&2

The script than get’s piped to the logger utility:
backup.sh 2>&1 | logger --prio-prefix -t backup

When inspecting the logs manually with journalctl, I see that the log levels are saved correctly in the journal.

Maybe I am using wrong label for systemd priority level? Is there an overview of builtin systemd/journal labels available somewhere?

Thank you in advance for your help.

2

For anyone bumping into this in the future. The correct field name is __journal_priority_keyword, as described in this page from Promtail documentation. The Promtail docs also link to the man page for systemd.journal-fields, which contains a list of available tags. Remember to prefix these with __journal_.

However, I still would like to know why keyword has to be included, as according to man systemd.journal-fields, the field name for priority is just PRIORITY. Shouldn’t it make the label exported by Promtail/Alloy be __journal_priority?