90 lines
2.7 KiB
Plaintext
90 lines
2.7 KiB
Plaintext
// Grafana Alloy configuration
|
|
// Collects:
|
|
// 1. Syslog over UDP/TCP port 514 — for MikroTik RB5009 and other network gear
|
|
// 2. Docker container logs — for all containers on this host
|
|
// Forwards everything to Loki.
|
|
|
|
// ── 1. SYSLOG RECEIVER ────────────────────────────────────────────────────────
|
|
// Listens on 514 UDP and TCP. Point your MikroTik logging action at this host.
|
|
|
|
loki.source.syslog "network_devices" {
|
|
listener {
|
|
address = "0.0.0.0:5140"
|
|
protocol = "udp"
|
|
syslog_format = "rfc3164"
|
|
labels = {
|
|
job = "syslog",
|
|
source = "network",
|
|
}
|
|
}
|
|
listener {
|
|
address = "0.0.0.0:5140"
|
|
protocol = "tcp"
|
|
syslog_format = "rfc3164"
|
|
labels = {
|
|
job = "syslog",
|
|
source = "network",
|
|
}
|
|
}
|
|
forward_to = [loki.process.syslog_relabel.receiver]
|
|
}
|
|
|
|
|
|
// Enrich syslog entries with a hostname label extracted from the syslog message
|
|
loki.process "syslog_relabel" {
|
|
forward_to = [loki.write.local_loki.receiver]
|
|
|
|
stage.labels {
|
|
values = {
|
|
// These internal __syslog_message_ labels are created by the source component
|
|
hostname = "__syslog_message_hostname",
|
|
app = "__syslog_message_app_name",
|
|
severity = "__syslog_message_severity",
|
|
facility = "__syslog_message_facility",
|
|
}
|
|
}
|
|
}
|
|
|
|
// ── 2. DOCKER CONTAINER LOGS ─────────────────────────────────────────────────
|
|
// Tails logs from all Docker containers on this host.
|
|
// Adds container name and image as labels for easy filtering.
|
|
|
|
discovery.docker "containers" {
|
|
host = "unix:///var/run/docker.sock"
|
|
}
|
|
|
|
// Relabel Docker metadata into useful Loki labels.
|
|
discovery.relabel "docker_labels" {
|
|
targets = discovery.docker.containers.targets
|
|
|
|
rule {
|
|
source_labels = ["__meta_docker_container_name"]
|
|
regex = "/(.*)"
|
|
target_label = "container"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_docker_container_log_stream"]
|
|
target_label = "stream"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_docker_image_name"]
|
|
target_label = "image"
|
|
}
|
|
}
|
|
|
|
loki.source.docker "docker_logs" {
|
|
host = "unix:///var/run/docker.sock"
|
|
targets = discovery.relabel.docker_labels.output
|
|
labels = { job = "docker" }
|
|
forward_to = [loki.write.local_loki.receiver]
|
|
}
|
|
|
|
|
|
// ── 3. LOKI WRITE TARGET ──────────────────────────────────────────────────────
|
|
|
|
loki.write "local_loki" {
|
|
endpoint {
|
|
url = "http://loki:3100/loki/api/v1/push"
|
|
}
|
|
}
|