From d422a6bd49a3d1f56ccbc18f417fe213b87ad59e Mon Sep 17 00:00:00 2001
From: Arne Teuke <arne_teuke@confdroid.com>
Date: Tue, 11 Mar 2025 13:29:25 +0100
Subject: [PATCH] source hostname label

---
 templates/config.alloy.erb | 57 ++++++++++----------------------------
 1 file changed, 14 insertions(+), 43 deletions(-)

diff --git a/templates/config.alloy.erb b/templates/config.alloy.erb
index a8402e5..b5f2f72 100644
--- a/templates/config.alloy.erb
+++ b/templates/config.alloy.erb
@@ -10,52 +10,23 @@ local.file_match "system_logs" {
   sync_period = "5s"
 }
 
-// Scrape the logs from the matched files
-loki.source.file "system_logs" {
-  targets    = local.file_match.system_logs.targets
-  forward_to = [loki.relabel.add_labels.receiver]
-}
-
-// Parse hostname from log lines (if structured)
-loki.process "parse_hostname" {
-  forward_to = [loki.relabel.add_labels.receiver]
-  stage.match {
-    selector = "{filename=~\"/var/log/.*\"}"
-    stage.regex {
-      expression = "^(?P<timestamp>[^ ]+ [^ ]+) (?P<hostname>[^ ]+) .*"
-      source     = "__content__"
-    }
-    stage.labels {
-      values = {
-        hostname = "hostname",  // Extracted from log line
-      }
+loki.process "syslog" {
+  stage.regex {
+    expression = `(?P[A-Z][a-z][a-z]\\s{1,2}\\d{1,2}\\s\\d{2}[:]\\d{2}[:]\\d{2})\\s(?P[\\w][\\w\\d\\.@-]*)\\s(?P.*)$`
+  }
+  stage.labels {
+    values = {
+      hostname = "host"
     }
   }
-}
-
-// Refine labels
-loki.relabel "add_labels" {
+  stage.timestamp {
+    source = "ts"
+    format = "Jan _2 15:04:05"
+  }
+  stage.output {
+    source = "log"
+  }
   forward_to = [loki.write.loki.receiver]
-  rule {
-    action       = "replace"
-    target_label = "job"
-    replacement  = "syslogs"
-  }
-  rule {
-    source_labels = ["__path__"]
-    target_label  = "filename"
-  }
-  // Prefer parsed hostname, fallback to system.hostname
-  rule {
-    source_labels = ["hostname"]
-    target_label  = "hostname"
-  }
-  //rule {
-  //  source_labels = ["hostname_fallback"]
-  //  target_label  = "hostname"
-  //  action        = "replace"
-  //  replacement   = "${__label:hostname_fallback}"  // Only if hostname is unset
-  //}
 }
 
 loki.write "loki" {