fix Alloy configuration after 'help' from Claude

loki/config/alloy.alloy

@@ -9,42 +9,42 @@
 
 loki.source.syslog "network_devices" {
   listener {
-    address  = "0.0.0.0:514"
-    protocol = "udp"
-    labels   = {
+    address       = "0.0.0.0:5140"
+    protocol      = "udp"
+    syslog_format = "rfc3164"
+    labels = {
       job    = "syslog",
       source = "network",
     }
   }
   listener {
-    address  = "0.0.0.0:514"
-    protocol = "tcp"
-    labels   = {
+    address       = "0.0.0.0:5140"
+    protocol      = "tcp"
+    syslog_format = "rfc3164"
+    labels = {
       job    = "syslog",
       source = "network",
     }
   }
-
-  // loki.source.syslog automatically extracts hostname, app, facility, and
-  // severity from RFC3164/RFC5424 messages and exposes them as internal
-  // labels. We promote them to real Loki labels in the process stage below.
   forward_to = [loki.process.syslog_relabel.receiver]
 }
 
-// Promote the syslog metadata fields to Loki labels.
+
+// Enrich syslog entries with a hostname label extracted from the syslog message
 loki.process "syslog_relabel" {
+  forward_to = [loki.write.local_loki.receiver]
+
   stage.labels {
     values = {
-      host     = "__syslog_message_hostname",
+      // These internal __syslog_message_ labels are created by the source component
+      hostname = "__syslog_message_hostname",
+      app      = "__syslog_message_app_name",
       severity = "__syslog_message_severity",
       facility = "__syslog_message_facility",
-      app      = "__syslog_message_app_name",
     }
   }
-  forward_to = [loki.write.default.receiver]
 }
 
-
 // ── 2. DOCKER CONTAINER LOGS ─────────────────────────────────────────────────
 // Tails logs from all Docker containers on this host.
 // Adds container name and image as labels for easy filtering.
@@ -76,13 +76,13 @@ loki.source.docker "docker_logs" {
   host       = "unix:///var/run/docker.sock"
   targets    = discovery.relabel.docker_labels.output
   labels     = { job = "docker" }
-  forward_to = [loki.write.default.receiver]
+  forward_to = [loki.write.local_loki.receiver]
 }
 
 
 // ── 3. LOKI WRITE TARGET ──────────────────────────────────────────────────────
 
-loki.write "default" {
+loki.write "local_loki" {
   endpoint {
     url = "http://loki:3100/loki/api/v1/push"
   }