73 lines
1.7 KiB
Plaintext
73 lines
1.7 KiB
Plaintext
// Log pipeline: files, Docker, journald → Loki (replaces Promtail).
|
|
// See: https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
url = "http://loki:3100/loki/api/v1/push"
|
|
}
|
|
}
|
|
|
|
// varlogs: /var/log/**/*.log
|
|
loki.source.file "varlogs" {
|
|
targets = [
|
|
{ __path__ = "/var/log/**/*.log", job = "varlogs", host = "cyberdeck" },
|
|
]
|
|
forward_to = [loki.write.default.receiver]
|
|
file_match {
|
|
enabled = true
|
|
sync_period = "10s"
|
|
}
|
|
}
|
|
|
|
// docker: container logs with docker parsing and container label from path
|
|
loki.source.file "docker" {
|
|
targets = [
|
|
{ __path__ = "/var/lib/docker/containers/*/*-json.log", job = "docker", host = "cyberdeck" },
|
|
]
|
|
forward_to = [loki.process.docker.receiver]
|
|
file_match {
|
|
enabled = true
|
|
sync_period = "10s"
|
|
}
|
|
}
|
|
|
|
loki.process "docker" {
|
|
forward_to = [loki.relabel.docker.receiver]
|
|
stage.docker {}
|
|
}
|
|
|
|
loki.relabel "docker" {
|
|
forward_to = [loki.write.default.receiver]
|
|
rule {
|
|
source_labels = ["filename"]
|
|
regex = "/var/lib/docker/containers/([^/]+)/.*"
|
|
target_label = "container"
|
|
replacement = "$1"
|
|
}
|
|
}
|
|
|
|
// journald: systemd journal with unit, host, level labels
|
|
loki.relabel "journald" {
|
|
forward_to = []
|
|
rule {
|
|
source_labels = ["__journal__systemd_unit"]
|
|
target_label = "unit"
|
|
}
|
|
rule {
|
|
source_labels = ["__journal__hostname"]
|
|
target_label = "host"
|
|
}
|
|
rule {
|
|
source_labels = ["__journal__priority_keyword"]
|
|
target_label = "level"
|
|
}
|
|
}
|
|
|
|
loki.source.journal "journald" {
|
|
forward_to = [loki.write.default.receiver]
|
|
relabel_rules = loki.relabel.journald.rules
|
|
labels = { job = "journald", host = "cyberdeck" }
|
|
path = "/var/log/journal"
|
|
max_age = "12h"
|
|
}
|