Issues with xpath query syntax and service will not start
// Prometheus exporter for Alloy’s own metrics
prometheus.exporter.self “integrations_alloy” { }
// Relabel Alloy metrics
discovery.relabel “integrations_alloy” {
targets = prometheus.exporter.self.integrations_alloy.targets
rule {
target_label = “instance”
replacement = constants.hostname
}
rule {
target_label = “alloy_hostname”
replacement = constants.hostname
}
rule {
target_label = “job”
replacement = “integrations/alloy-check”
}
}
// Scrape Alloy metrics
prometheus.scrape “integrations_alloy” {
targets = discovery.relabel.integrations_alloy.output
forward_to = [prometheus.relabel.integrations_alloy.receiver]
scrape_interval = “60s”
}
// Relabel Alloy metrics before remote write
prometheus.relabel “integrations_alloy” {
forward_to = [prometheus.remote_write.metrics_service.receiver]
rule {
source_labels = [“name”]
regex = “.*”
action = “keep”
}
}
// Windows exporter for system metrics with service filtering
prometheus.exporter.windows “integrations_windows_exporter” {
enabled_collectors = [“ad”, “dns”, “cpu”, “cs”, “logical_disk”, “net”, “os”, “service”, “system”, “time”, “diskdrive”, “tcp”, “memory”, “cpu_info”, “Service”, “Process”, “terminal_services”]
service {
where_clause = “Name = ‘Dnscache’ OR Name = ‘WinRM’ OR Name = ‘wuauserv’”
}
}
// Relabel Windows exporter metrics
discovery.relabel “integrations_windows_exporter” {
targets = prometheus.exporter.windows.integrations_windows_exporter.targets
rule {
target_label = “job”
replacement = “integrations/windows_exporter”
}
rule {
target_label = “instance”
replacement = constants.hostname
}
}
// Scrape Windows exporter metrics
prometheus.scrape “integrations_windows_exporter” {
targets = discovery.relabel.integrations_windows_exporter.output
forward_to = [prometheus.relabel.integrations_windows_exporter.receiver]
job_name = “integrations/windows_exporter”
}
// Relabel Windows exporter metrics before remote write
prometheus.relabel “integrations_windows_exporter” {
forward_to = [prometheus.remote_write.metrics_service.receiver]
rule {
source_labels = [“name”]
regex = “.*”
action = “keep”
}
}
// Process Security logs
loki.process “logs_integrations_windows_exporter_security” {
forward_to = [loki.write.grafana_cloud_loki.receiver]
stage.json {
expressions = {
level = “levelText”,
source = “source”,
logon_type = “EventData.LogonType”, // Updated to access nested field
}
}
stage.drop {
expression = “^3$” // Use regex for exact match
source = “logon_type”
}
stage.labels {
values = {
logon_type = “logon_type”,
username = “username”,
hostname = “hostname”,
timestamp = “timestamp”,
}
}
}
// Relabel Security logs
loki.relabel “logs_integrations_windows_exporter_security” {
forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]
rule {
source_labels = [“computer”]
target_label = “agent_hostname”
}
}
// Collect Security logs (no EventID filter)
loki.source.windowsevent “logs_integrations_windows_exporter_security” {
locale = 1033
eventlog_name = “Security”
bookmark_path = “./bookmarks-sec.xml”
poll_interval = “5s”
use_incoming_timestamp = true
//xpath_query = “[System[((EventID=4624 and EventData/Data[@Name=‘LogonType’]=‘2’) or (EventID=4624 and EventData/Data[@Name=‘LogonType’]=‘5’) or (EventID=4624 and EventData/Data[@Name=‘LogonType’]=‘10’)) or (EventID=4625 and (EventData/Data[@Name=‘LogonType’]=‘2’ or EventData/Data[@Name=‘LogonType’]=‘5’ or EventData/Data[@Name=‘LogonType’]=‘10’))]]"
//xpath_query = "[System[(EventID=4624 or EventID=4625)] and EventData[Data[@Name=‘LogonType’]=‘2’ or Data[@Name=‘LogonType’]=‘5’ or Data[@Name=‘LogonType’]=‘10’]]”
//xpath_query = “[System[(EventID=4624 and EventData[Data[@Name=‘LogonType’]=‘2’ or Data[@Name=‘LogonType’]=‘5’ or Data[@Name=‘LogonType’]=‘10’]) or (EventID=4625)]]"
xpath_query = "[System[(EventID=4624 and (EventData/Data[@Name=‘LogonType’]=‘2’ or EventData/Data[@Name=‘LogonType’]=‘5’ or EventData/Data[@Name=‘LogonType’]=‘10’)) or (EventID=4625 and not(EventData/Data[@Name=‘Status’]=‘0xC000006D’ or EventData/Data[@Name=‘SubStatus’]=‘0xC000006A’))]]”
forward_to = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
labels = {
instance = constants.hostname,
job = “integrations/windows_exporter”,
}
}
// Process logs to add EventID and other labels
loki.process “enrich” {
stage.labels {
values = {
logon_type = “logon_type”,
username = “username”,
hostname = “hostname”,
timestamp = “timestamp”,
}
}
forward_to = [loki.write.grafana_cloud_loki.receiver]
}
// Remote write to Prometheus/Mimir
prometheus.remote_write “metrics_service” {
endpoint {
url = “http://192.168.1.106:9009/api/v1/push”
headers = {
“X-Scope-OrgID” = “anonymous”,
}
}
}
// Write to Loki
loki.write “grafana_cloud_loki” {
endpoint {
url = “http://192.168.1.106:3100/loki/api/v1/push”
}
}