source hostname label

templates/config.alloy.erb

@@ -10,52 +10,23 @@ local.file_match "system_logs" {
   sync_period = "5s"
 }
 
-// Scrape the logs from the matched files
-loki.source.file "system_logs" {
-  targets    = local.file_match.system_logs.targets
-  forward_to = [loki.relabel.add_labels.receiver]
-}
-
-// Parse hostname from log lines (if structured)
-loki.process "parse_hostname" {
-  forward_to = [loki.relabel.add_labels.receiver]
-  stage.match {
-    selector = "{filename=~\"/var/log/.*\"}"
+loki.process "syslog" {
   stage.regex {
-      expression = "^(?P<timestamp>[^ ]+ [^ ]+) (?P<hostname>[^ ]+) .*"
-      source     = "__content__"
+    expression = `(?P[A-Z][a-z][a-z]\\s{1,2}\\d{1,2}\\s\\d{2}[:]\\d{2}[:]\\d{2})\\s(?P[\\w][\\w\\d\\.@-]*)\\s(?P.*)$`
   }
   stage.labels {
     values = {
-        hostname = "hostname",  // Extracted from log line
+      hostname = "host"
     }
   }
+  stage.timestamp {
+    source = "ts"
+    format = "Jan _2 15:04:05"
   }
+  stage.output {
+    source = "log"
   }
-
-// Refine labels
-loki.relabel "add_labels" {
   forward_to = [loki.write.loki.receiver]
-  rule {
-    action       = "replace"
-    target_label = "job"
-    replacement  = "syslogs"
-  }
-  rule {
-    source_labels = ["__path__"]
-    target_label  = "filename"
-  }
-  // Prefer parsed hostname, fallback to system.hostname
-  rule {
-    source_labels = ["hostname"]
-    target_label  = "hostname"
-  }
-  //rule {
-  //  source_labels = ["hostname_fallback"]
-  //  target_label  = "hostname"
-  //  action        = "replace"
-  //  replacement   = "${__label:hostname_fallback}"  // Only if hostname is unset
-  //}
 }
 
 loki.write "loki" {