Transform (decode a value, add new fields) using Grafana Alloy

Grafana Alloy
1

A Kubernetes log message (a JSON string) has a field with a JSON Web Token (JWT) as its value. I need to unfurl/decode, add new fields (key: value) using the unfurled information and replace the original value before shipping it to Loki.

I have done this with fluentd and otel-splunk-connect but I am having a hard time with Alloy (using the grafana/alloy helm chart).

I am able to replace using the stage.replace block but before I do the replace, I need to unfurl the JWT and add new fields to the existing log message before sending it to Loki. Is there an Alloy-native way to do this by configuring the config.alloy file? I would be happy with running arbitrary code as well (as I have with fluentd).

Documentation here says the Alloy configuration syntax contains a standard library and shows a couple of examples like encoding.from_json(local.file.cfg.content)["namespace"] but how would this fit in a config file block?

2

Hello! If the json value you’re extracting is a string you can use encoding.from_json to supply a string to any string attribute. For example:

stage.replace {
  source = encoding.from_json(local.file.cfg.content)["token"]
}