I’m using Alloy to feed logs to Loki (on Grafana Cloud). When I view the logs in Grafana, log lines have a service_name label which matches the app label I generated, or syslog_id if there was none.
I don’t know where the service_nameis being set though - it’s not in my Alloy config, and when I look at the live debug output of the final stage (before the writer), it’s not there.
eg this even is getting labelled with service_name=systemd-journal, which is the same as its job. But if app is set that gets picked up instead.
[IN]: timestamp: 2026-02-11T16:25:50.692205+11:00, entry: error: kex_exchange_identification: Connection closed by remote host, labels: {job="loki.source.journal.read_systemd", level="error", syslog_id="sshd"}, structured_metadata: {}
[OUT]: timestamp: 2026-02-11T16:25:50.692205+11:00, entry: error: kex_exchange_identification: Connection closed by remote host, labels: {instance="dbtest1", job="systemd-journal", level="error", syslog_id="sshd"}, structured_metadata: {}