// Grafana Alloy configuration
// Collects:
//   1. Syslog over UDP/TCP port 514  — for MikroTik RB5009 and other network gear
//   2. Docker container logs          — for all containers on this host
// Forwards everything to Loki.

// ── 1. SYSLOG RECEIVER ────────────────────────────────────────────────────────
// Listens on 514 UDP and TCP. Point your MikroTik logging action at this host.

loki.source.syslog "network_devices" {
  listener {
    address       = "0.0.0.0:5140"
    protocol      = "udp"
    syslog_format = "rfc3164"
    labels = {
      job    = "syslog",
      source = "network",
    }
  }
  listener {
    address       = "0.0.0.0:5140"
    protocol      = "tcp"
    syslog_format = "rfc3164"
    labels = {
      job    = "syslog",
      source = "network",
    }
  }
  forward_to = [loki.process.syslog_relabel.receiver]
}


// Enrich syslog entries with a hostname label extracted from the syslog message
loki.process "syslog_relabel" {
  forward_to = [loki.write.local_loki.receiver]

  stage.labels {
    values = {
      // These internal __syslog_message_ labels are created by the source component
      hostname = "__syslog_message_hostname",
      app      = "__syslog_message_app_name",
      severity = "__syslog_message_severity",
      facility = "__syslog_message_facility",
    }
  }
}

// ── 2. DOCKER CONTAINER LOGS ─────────────────────────────────────────────────
// Tails logs from all Docker containers on this host.
// Adds container name and image as labels for easy filtering.

discovery.docker "containers" {
  host = "unix:///var/run/docker.sock"
}

// Relabel Docker metadata into useful Loki labels.
discovery.relabel "docker_labels" {
  targets = discovery.docker.containers.targets

  rule {
    source_labels = ["__meta_docker_container_name"]
    regex         = "/(.*)"
    target_label  = "container"
  }
  rule {
    source_labels = ["__meta_docker_container_log_stream"]
    target_label  = "stream"
  }
  rule {
    source_labels = ["__meta_docker_image_name"]
    target_label  = "image"
  }
}

loki.source.docker "docker_logs" {
  host       = "unix:///var/run/docker.sock"
  targets    = discovery.relabel.docker_labels.output
  labels     = { job = "docker" }
  forward_to = [loki.write.local_loki.receiver]
}


// ── 3. LOKI WRITE TARGET ──────────────────────────────────────────────────────

loki.write "local_loki" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}