revert hostname label

templates/config.alloy.erb

@@ -10,25 +10,53 @@ local.file_match "system_logs" {
   sync_period = "5s"
 }
 
-loki.process "syslog" {
+// Scrape the logs from the matched files
-  stage.regex {
+loki.source.file "system_logs" {
-    expression = `(?P<ts>[A-Z][a-z]{2}\s{1,2}\d{1,2}\s\d{2}:\d{2}:\d{2})\s(?P<host>[\w\.\@-]+)\s(?P<log>.*)$`
+  targets    = local.file_match.system_logs.targets
-  }
+  forward_to = [loki.relabel.add_labels.receiver]
-  stage.labels {
-    values = {
-      hostname = "${host}"
-    }
-  }
-  stage.timestamp {
-    source = "ts"
-    format = "Jan _2 15:04:05"
-  }
-  stage.output {
-    source = "log"
-  }
-  forward_to = [loki.write.loki.receiver]
 }
 
+// Parse hostname from log lines (if structured)
+loki.process "parse_hostname" {
+  forward_to = [loki.relabel.add_labels.receiver]
+  stage.match {
+    selector = "{filename=~\"/var/log/.*\"}"
+    stage.regex {
+      expression = "^(?P<timestamp>[^ ]+ [^ ]+) (?P<hostname>[^ ]+) .*"
+      source     = "__content__"
+    }
+    stage.labels {
+      values = {
+        hostname = "hostname",  // Extracted from log line
+      }
+    }
+  }
+}
+
+// Refine labels
+loki.relabel "add_labels" {
+  forward_to = [loki.write.loki.receiver]
+  rule {
+    action       = "replace"
+    target_label = "job"
+    replacement  = "syslogs"
+  }
+  rule {
+    source_labels = ["__path__"]
+    target_label  = "filename"
+  }
+  // Prefer parsed hostname, fallback to system.hostname
+  rule {
+    source_labels = ["hostname"]
+    target_label  = "hostname"
+  }
+  //rule {
+  //  source_labels = ["hostname_fallback"]
+  //  target_label  = "hostname"
+  //  action        = "replace"
+  //  replacement   = "${__label:hostname_fallback}"  // Only if hostname is unset
+  }
+}
 
 loki.write "loki" {
   endpoint {