Too many unknown log entries

Grafana Alloy
,
1

Hi,

My config.alloy works quite fine, it process logs rather as I would like to see them in Loki, but one thing can’t stop me thinking about that, is possible to for example change all unknown logs entries to INFO or at least not showing up them in Loki?

My extracted part of the config file works in this way to show only ERROR, however as I said with many unknown entries in Loki also:

  stage.match {
    selector = "{filename=~\".+\"} |~ \"(INFO)\""
    action   = "drop"
  }

When I click on ERROR log entry in Loki it actually shows the label with ERROR value, however when I click on unknown entry it does not show any label. Loki cant match it to any of them?

I reviewed that community forum and in some of them I saw that it is not recommended to alter logs schema, so maybe I should leave with that and not over-engineering over here?

2

If you only care about error logs, why not filter everything except errors? like:

stage.match {
    selector = "{filename=~\".+\"} !~ \"(ERROR)\""
    action   = "drop"
  }