I want to capture the log level as a label in Kubernetes’ events log
$ kubectl get events
LAST SEEN TYPE REASON OBJECT MESSAGE
16m Normal Scheduled pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf Successfully assigned default/aaaaaaaaaaaaaa-7c949b9568-sl4jf to tech-lab-08
15m Normal Pulling pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf Pulling image "ghcr.io/moelove/non-exist"
15m Warning Failed pod/aaaaaaaaaaaaaa-7c949b9568-sl4jf Failed to pull image "ghcr.io/moelove/non-exist": failed to pull and unpack image "ghcr.io/moelove/non-exist:latest": failed to resolve reference "ghcr.io/moelove/non-exist:latest": failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Amoelove%2Fnon-exist%3Apull&service=ghcr.io: 403 Forbidden
This is my alloy configuration, and I wanted to create a new tag ‘log_level’ with a value derived from type=Warning in the capture log, but it didn’t work as expected
content: |-
loki.source.kubernetes_events "cluster_events" {
job_name = "integrations/kubernetes/eventhandler"
log_format = "logfmt"
forward_to = [
loki.process.cluster_events.receiver,
]
}
loki.process "cluster_events" {
forward_to = [loki.write.loki.receiver]
stage.drop {
expression = "type=Normal"
//longer_than = "1KB"
}
stage.static_labels {
values = {
cluster = "inboc-test",
}
}
stage.labels {
values = {
kubernetes_cluster_events = "job",
}
}
stage.regex {
expression = `(?P<level>(?i)\b(type=Warning|type=Normal)\b)`
}
stage.labels {
values = { "log_level" = "level" }
}
}