add hostname label

templates/config.alloy.erb

@@ -16,23 +16,51 @@ loki.source.file "system_logs" {
   forward_to = [loki.relabel.add_labels.receiver]
 }
 
-// Add hostname using system.hostname
+// Parse hostname from log lines (if structured)
-loki.process "add_hostname" {
+loki.process "parse_hostname" {
   forward_to = [loki.relabel.add_labels.receiver]
+  stage.match {
+    selector = "{filename=~\"/var/log/.*\"}"
+    stage.regex {
+      expression = "^(?P<timestamp>[^ ]+ [^ ]+) (?P<hostname>[^ ]+) .*"
+      source     = "__content__"
+    }
+    stage.labels {
+      values = {
+        hostname = "hostname",  // Extracted from log line
+      }
+    }
+  }
+  // Fallback: Set hostname explicitly if not parsed
   stage.static_labels {
     values = {
-      hostname = system.hostname,  // Grabs the local hostname (e.g., fm002)
+      hostname_fallback = system.hostname,  // e.g., fm002
     }
   }
 }
 
-// Add hostname and job labels
+// Refine labels
 loki.relabel "add_labels" {
   forward_to = [loki.write.loki.receiver]
   rule {
     action       = "replace"
     target_label = "job"
-    replacement  = "syslogs"  // Or any name you prefer, e.g., "syslogs"
+    replacement  = "syslogs"
+  }
+  rule {
+    source_labels = ["__path__"]
+    target_label  = "filename"
+  }
+  // Prefer parsed hostname, fallback to system.hostname
+  rule {
+    source_labels = ["hostname"]
+    target_label  = "hostname"
+  }
+  rule {
+    source_labels = ["hostname_fallback"]
+    target_label  = "hostname"
+    action        = "replace"
+    replacement   = "${__label:hostname_fallback}"  // Only if hostname is unset
   }
 }