Using loki.process for unstructured logs

Hi there,

Is it possible to use loki.process for unstructured logs?

My log pattern is: - - [16/Feb/2024:12:18:33 +0000] "GET /matrix%20systemic%20logistical.hmtl HTTP/1.1" 200 2936 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_9_6 rv:5.0) Gecko/1938-27-10 Firefox/35.0"

And I can use the LogQL as below to label my logs:

| pattern `<request_ip_address> - <userid> <timestamp> "<request_method> <request_route> <_>" <response_code> <object_size> <http_referrer> "<user_agent>" <_>`

Loki provides loki.process to pre-process before sending to Loki:

But I can’t find any BLOCK method related to unstructured logs.
stage.regex may be able to do that, but it is easier to use the pattern method.

You’ll have to use regex with group capture.

1 Like

Hi Tony,

Thanks for your suggestion.