source hostname label

templates/config.alloy.erb

@@ -10,52 +10,23 @@ local.file_match "system_logs" {
   sync_period = "5s"
 }
 
-// Scrape the logs from the matched files
+loki.process "syslog" {
-loki.source.file "system_logs" {
+  stage.regex {
-  targets    = local.file_match.system_logs.targets
+    expression = `(?P[A-Z][a-z][a-z]\\s{1,2}\\d{1,2}\\s\\d{2}[:]\\d{2}[:]\\d{2})\\s(?P[\\w][\\w\\d\\.@-]*)\\s(?P.*)$`
-  forward_to = [loki.relabel.add_labels.receiver]
+  }
-}
+  stage.labels {
-
+    values = {
-// Parse hostname from log lines (if structured)
+      hostname = "host"
-loki.process "parse_hostname" {
-  forward_to = [loki.relabel.add_labels.receiver]
-  stage.match {
-    selector = "{filename=~\"/var/log/.*\"}"
-    stage.regex {
-      expression = "^(?P<timestamp>[^ ]+ [^ ]+) (?P<hostname>[^ ]+) .*"
-      source     = "__content__"
-    }
-    stage.labels {
-      values = {
-        hostname = "hostname",  // Extracted from log line
-      }
     }
   }
-}
+  stage.timestamp {
-
+    source = "ts"
-// Refine labels
+    format = "Jan _2 15:04:05"
-loki.relabel "add_labels" {
+  }
+  stage.output {
+    source = "log"
+  }
   forward_to = [loki.write.loki.receiver]
-  rule {
-    action       = "replace"
-    target_label = "job"
-    replacement  = "syslogs"
-  }
-  rule {
-    source_labels = ["__path__"]
-    target_label  = "filename"
-  }
-  // Prefer parsed hostname, fallback to system.hostname
-  rule {
-    source_labels = ["hostname"]
-    target_label  = "hostname"
-  }
-  //rule {
-  //  source_labels = ["hostname_fallback"]
-  //  target_label  = "hostname"
-  //  action        = "replace"
-  //  replacement   = "${__label:hostname_fallback}"  // Only if hostname is unset
-  //}
 }
 
 loki.write "loki" {