modified: roles/grafana_alloy/templates/config.alloy.j2

roles/grafana_alloy/templates/config.alloy.j2

@@ -38,22 +38,37 @@ prometheus.exporter.unix "integrations_node_exporter" {
     netdev {
         device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
     }
-}        
+}  
 
-// logs loki
+
+// ============================================
+// LOKI WRITE TARGET
+// ============================================
 loki.write "loki_srv" {
-    endpoint {
-        url = "{{ loki.endpoint.url }}"
-    }
+  endpoint {
+    url = sys.env("loki.endpoint.url")
+  }
 }
 
-// logs - journald
-loki.source.journal "logs_journal_scrape" {
-    max_age       = "24h0m0s"
-    relabel_rules = discovery.relabel.logs_journal_scrape.rules
-    forward_to    = [loki.write.loki_srv.receiver]
+// ============================================
+// JOURNALD SOURCE
+// ============================================
+// Read journald logs
 
-    labels = {
+loki.source.journal "journal" {
+  max_age   = "24h"
+  relabel_rules = discovery.relabel.journald.rules
+  forward_to    = [loki.process.journald.receiver]
+}
+
+// ============================================
+// HOST JOURNALD PROCESSING
+// ============================================
+
+// Add static labels and forward journald logs to Loki
+loki.process "journal" {
+  stage.static_labels {
+    values = {
         job  = "integrations/journald",
         host = "{{ inventory_hostname }}",
         {% if loki.labels is defined and loki.labels %}
@@ -62,30 +77,41 @@ loki.source.journal "logs_journal_scrape" {
         {% endfor %}
         {% endif %}
     }
+  }
+  forward_to = [loki.write.loki_srv.receiver]
 }
 
-// logs - journald - relabel
-discovery.relabel "logs_journal_scrape" {
-    targets = []
 
-    rule {
-        source_labels = ["__journal__systemd_unit"]
-        target_label  = "systemd_unit"
-    }
+// ============================================
+// HOST JOURNALD RELABELING
+// ============================================
 
-    rule {
-        source_labels = ["__journal_syslog_identifier"]
-        target_label  = "syslog_identifier"
-    }
+// Convert journald metadata into Loki labels
+discovery.relabel "journald" {
+  targets = []
 
-    rule {
-        source_labels = ["__journal__transport"]
-        target_label  = "journal_transport"
-    }
+  // syslog_identifier
+  rule {
+    source_labels = ["__journal_syslog_identifier"]
+    target_label  = "syslog_identifier"
+  }
 
-    rule {
-        source_labels = ["__journal_priority_keyword"]
-        target_label  = "level"
-    }
+  // Systemd unit name
+  rule {
+    source_labels = ["__journal__systemd_unit"]
+    target_label  = "systemd_unit"
+  }
+
+  // Transport type (stdout, syslog, kernel, audit, etc.)
+  rule {
+    source_labels = ["__journal__transport"]
+    target_label  = "journal_transport"
+  }
+
+  // Priority (info, warning, error)
+  rule {
+    source_labels = ["__journal_priority_keyword"]
+    target_label  = "level"
+  }
 }