From a05dc843b6ea7c88e9213eb9c24ca04b889244e7 Mon Sep 17 00:00:00 2001
From: Arne Teuke <arne_teuke@confdroid.com>
Date: Tue, 11 Mar 2025 15:54:01 +0100
Subject: [PATCH] journal hostname label

---
 templates/config.alloy.erb | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/templates/config.alloy.erb b/templates/config.alloy.erb
index 296112a..5475c0a 100644
--- a/templates/config.alloy.erb
+++ b/templates/config.alloy.erb
@@ -1,5 +1,29 @@
 <% if @ay_manage_loki == true -%>
 
+// Receive syslog messages
+loki.source.syslog "syslog" {
+  listener {
+    address = "0.0.0.0:514"  // Adjust to your required listening port
+  }
+  forward_to = [loki.process.extract_hostname.receiver]
+}
+
+// Process logs and extract hostname
+loki.process "extract_hostname" {
+  stage.logfmt {
+    mapping = {
+      "hostname" = "syslog_hostname"  // Extracts the hostname from syslog
+    }
+  }
+  stage.labels {
+    values = {
+      "hostname" = "hostname"  // Assigns extracted hostname to the label
+    }
+  }
+  forward_to = [loki.write.loki.receiver]
+}
+
+
 // Define file discovery for your logs
 local.file_match "system_logs" {
   path_targets = [
@@ -21,11 +45,6 @@ loki.relabel "add_labels" {
   forward_to = [loki.write.loki.receiver]
 
   rule {
-    action        = "replace"
-    source_labels = ["__journal__hostname"]
-    target_label  = "hostname"
-  }
-    rule {
     action       = "replace"
     target_label = "job"
     replacement  = "syslogs"