What am I missing to pass these new labels from Loki - Alloy - Grafana? (Docker setup)

Grafana Alloy
1

image
image604×540 10.6 KB

Using an image because the paste didn’t work - but anyway, I’ve searched everywhere - my logs come in, everything is good, the link and syntax is fine. I’m just not getting ‘username’ label being passed :confused:

I did read through a bunch of the suggested posts before I made this one. Any suggestions would be great - even pointers to an exact page I can read more about how regex and the loki.process and new labels work, for docker?

2

Try:

stage.labels {
  values = {
    testusername = "username",
  }
}

stage.static_labels {
  values = {
    service = "jellyfin",
    job        = "jellylogs",
  }
}
3

image
image837×173 6.29 KB
Still no testusername label that I expect :confused: (And yes, I am selecting a log line with a denied user I tested with real quick)

I probably have it labeled wrong nder stage.labels = should it just be ‘username’?

image
image479×274 4.09 KB

And for what it’s worth, here’s my log line:
image

4

I see, your regex is probably wrong, can you give me a sample log line?

Never mind, I see it. Try this:

loki.process "jellyfin_pipeline {
  stage.regex {
    expression = `^.*Authentication request for \"(?P<username>[^\"]+)\"`
  }

  stage.labels {
    values = {
      testusername = "username",
    }
  }

  stage.static_labels {
    values = {
      service = "jellyfin",
      job        = "jellylogs",
    }
  }
}
5 
// Welcome to the Grafana Alloy Configurator!
// You can paste your configuration here or start by using the configuration wizard or by loading an example from the catalog.
local.file_match "jellyfin_logs" {
  path_targets = [
    {
      __path__ = "/share/Media/Data/docker/jellyfin/config/log/*log",
      job      = "jellylogs",
      service  = "jellyfin",
    },
  ]
}

loki.source.file "jellyfin_logs" {
  targets    = local.file_match.jellyfin_logs.targets
  forward_to = [loki.process.jellyfin_pipeline.receiver]
}

loki.process "jellyfin_pipeline" {
  stage.regex {
    expression = "Authentication request for \"(?P<username>[^\"]+)\""
  }
  stage.static_labels {
    values = {
      "msg" = "pipeline-hit",
    }
  }
  stage.labels {
    values = {
      "user" = "username",
    }
  }
  forward_to = [
    loki.write.default.receiver,
  ]
}

loki.write "default" {
  endpoint {
    url = "http://192.168.1.6:3100/loki/api/v1/push"
  }
}

I fixed it. Finally. It took forever. So many use cases for this stuff, but MY GOD. Someone please save this for posterity, because even the Grafana Alloy Configurator steered me wrong. I truly appreciate everyone’s attempt at help :slight_smile: I finally have User being pulled in as a label in Grafana and setting up alerts now. Jesus, you have no idea how relieved I am now…

For the record, I couldn’t FIND any log telling me what was wrong. Grafana Alloy said nothing. Grafana said nothing. Loki said nothing. I was going MAD.