What's wrong with log-level comprehension

Grafana Alloy
1

Hi,

I’ve some Kubernetes pods that log json to stderr :

{"level":"info","component":"libsmc","time":"2024-08-07T16:23:28+02:00","message":"Connected to https://x.x.x.x:8082/6.10"}
{"level":"info","action":"get_engines","count":118,"time":"2024-08-07T16:23:36+02:00","message":"Found firewalls"}
{"level":"warn","action":"get_engines","engine_name":"xxxxxxxxxx","engine_href":"/elements/single_fw/10584","time":"2024-08-07T16:23:36+02:00","message":"Firewall skipped (no timezone)"}
{"level":"warn","action":"get_engines","engine_name":"xxxxxxxxxx","engine_href":"/elements/single_fw/10582","time":"2024-08-07T16:23:36+02:00","message":"Firewall skipped (no timezone)"}
{"level":"info","action":"get_engines","count":22,"time":"2024-08-07T16:23:39+02:00","message":"Found firewalls"}
{"level":"info","count":138,"action":"get_engines","time":"2024-08-07T16:23:39+02:00","message":"Total firewalls found"}
{"level":"info","action":"engine_by_timezone","engines":5,"time":"2024-08-07T16:23:39+02:00","message":"Total firewalls found with hour 11"}

I’ve configured Alloy to get pod logs using this steps:

image
image759×1335 44 KB

Logs are presents on Loki, but log level is sometimes ok, sometimes wrong:

image
image1611×946 148 KB

How to have loki log-levels matching the “real” log-level?

Thanks for your support,

Sébastien

2

The feels like something else is writing the level label. I’d recommend trying to use a JSON filter to parse it, and just set the level label yourself, and see if that fixes it.

Please share your alloy configuration as well, if that doesn’t work.