Urldecoding log fields in alloy for loki

Grafana Alloy
1

We’re getting some webserver logs that contain urlencoded mac addresses. I’d like to normalise these before sending to loki, but i cant find a nice way to do it - is there something sensible im missing?

stage.replace seems like it’ll do what i want, but expression must be RE with capture blocks. Fine if there’s just one, but in a mac address, if i set this to .*(%3a).* it will match (and therefore replace) only the last occurrence. So this works:

```
stage.replace {
source = “device_mac_raw”
expression = “(?:[0-9A-Fa-f]{2})(%3[Aa]|-)(?:[0-9A-Fa-f]{2})(%3[Aa]|-)(?:[0-9A-Fa-f]{2})(%3[Aa]|-)(?:[0-9A-Fa-f]{2})(%3[Aa]|-)(?:[0-9A-Fa-f]{2})(%3[Aa]|-)(?:[0-9A-Fa-f]{2})”
replace = “:”
```

Is there a cleaner way?

2
  1. Can you give a concrete example?
  2. When you say “normalize”, do you mean replacing the text in the log string, or something else?
3

Thanks @tonyswumac

Here’s a urlencoded mac address: e0%3A1b%3Ae7%3A50%3A7b%3A02
Here’s what i want to see (normalized): e0:1b:e7:50:7b:02

I’d actually like that in uppercase, but we can ignore that for now and just undo the url encoding. The nasty stage.replace works, but i wonder if there’s a better way: urlencoded data isnt uncommon.

4

Unfortunately I don’t think this is possible.