modified: roles/grafana_alloy/templates/config.alloy.j2

roles/grafana_alloy/templates/config.alloy.j2

@@ -40,20 +40,35 @@ prometheus.exporter.unix "integrations_node_exporter" {
     }
 }  
 
-// logs loki
+
+// ============================================
+// LOKI WRITE TARGET
+// ============================================
 loki.write "loki_srv" {
-    endpoint {
+  endpoint {
-        url = "{{ loki.endpoint.url }}"
+    url = sys.env("loki.endpoint.url")
-    }
+  }
 }
 
-// logs - journald
+// ============================================
-loki.source.journal "logs_journal_scrape" {
+// JOURNALD SOURCE
-    max_age       = "24h0m0s"
+// ============================================
-    relabel_rules = discovery.relabel.logs_journal_scrape.rules
+// Read journald logs
-    forward_to    = [loki.write.loki_srv.receiver]
 
-    labels = {
+loki.source.journal "journal" {
+  max_age   = "24h"
+  relabel_rules = discovery.relabel.journald.rules
+  forward_to    = [loki.process.journald.receiver]
+}
+
+// ============================================
+// HOST JOURNALD PROCESSING
+// ============================================
+
+// Add static labels and forward journald logs to Loki
+loki.process "journal" {
+  stage.static_labels {
+    values = {
         job  = "integrations/journald",
         host = "{{ inventory_hostname }}",
         {% if loki.labels is defined and loki.labels %}
@@ -62,30 +77,41 @@ loki.source.journal "logs_journal_scrape" {
         {% endfor %}
         {% endif %}
     }
+  }
+  forward_to = [loki.write.loki_srv.receiver]
 }
 
-// logs - journald - relabel
-discovery.relabel "logs_journal_scrape" {
-    targets = []
 
-    rule {
+// ============================================
-        source_labels = ["__journal__systemd_unit"]
+// HOST JOURNALD RELABELING
-        target_label  = "systemd_unit"
+// ============================================
-    }
 
-    rule {
+// Convert journald metadata into Loki labels
-        source_labels = ["__journal_syslog_identifier"]
+discovery.relabel "journald" {
-        target_label  = "syslog_identifier"
+  targets = []
-    }
 
-    rule {
+  // syslog_identifier
-        source_labels = ["__journal__transport"]
+  rule {
-        target_label  = "journal_transport"
+    source_labels = ["__journal_syslog_identifier"]
-    }
+    target_label  = "syslog_identifier"
+  }
 
-    rule {
+  // Systemd unit name
-        source_labels = ["__journal_priority_keyword"]
+  rule {
-        target_label  = "level"
+    source_labels = ["__journal__systemd_unit"]
-    }
+    target_label  = "systemd_unit"
+  }
+
+  // Transport type (stdout, syslog, kernel, audit, etc.)
+  rule {
+    source_labels = ["__journal__transport"]
+    target_label  = "journal_transport"
+  }
+
+  // Priority (info, warning, error)
+  rule {
+    source_labels = ["__journal_priority_keyword"]
+    target_label  = "level"
+  }
 }