From 57fed34205038956452b5fba61f66c60e059361b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20Morel?= <emile.morel@ielo.net>
Date: Sat, 23 May 2026 19:51:00 +0200
Subject: [PATCH] Add loki plugin in logstash and add configuration to use it.

---
 .env.template                   |  4 +++-
 README.md                       |  4 ++++
 docker-compose.yml              |  2 ++
 logstash/Dockerfile             |  1 +
 logstash/pipeline/logstash.conf | 16 ++++++++++++++--
 5 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/.env.template b/.env.template
index f6e949b..093559c 100644
--- a/.env.template
+++ b/.env.template
@@ -40,4 +40,6 @@ WEBHOOK_PORT=8081
 WEBHOOK_URI=/
 WEBHOOK_TLS_ON=off
 SSH_COMMAND_READ_TIMEOUT=60
-EXPORT_TO_TOPOLOGRAPH_SOCKET=True
\ No newline at end of file
+EXPORT_TO_TOPOLOGRAPH_SOCKET=True
+EXPORT_TO_LOKI_BOOL=False
+LOKI_URL=http://loki.local:3100/loki/api/v1/push
diff --git a/README.md b/README.md
index 493a9b1..94b18ee 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,10 @@ If a subnet was removed from OSPF node (the node withdrew it from the announceme
 HTTP POST messages can be easily accepted by messengers, which allows to get instant notifications of OSPF topology changes:
 ![](docs/slack/slack_notification.PNG)
 
+## Push IS-IS topology changes to loki
+
+You can configure [loki](https://grafana.com/oss/loki/) to send topology changes. Simply edit `.env` and adapt `EXPORT_TO_LOKI_BOOL` and `LOKI_URL`. 
+
 ## Quick lab
 #### Containerlab
 Here is a lab for tracking OSPF topology changes placed here **containerlab/frr01**. Watcher logs:  
diff --git a/docker-compose.yml b/docker-compose.yml
index bd31588..fbc3243 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -40,6 +40,8 @@ services:
       EXPORT_TO_TOPOLOGRAPH_SOCKET: $EXPORT_TO_TOPOLOGRAPH_SOCKET
       TOPOLOGRAPH_HOST: $TOPOLOGRAPH_HOST
       TOPOLOGRAPH_PORT: $TOPOLOGRAPH_PORT
+      EXPORT_TO_LOKI_BOOL: $EXPORT_TO_LOKI_BOOL
+      LOKI_URL: $LOKI_URL
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:9600"]
       interval: 5s
diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index 72abf64..fcc5d06 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -7,4 +7,5 @@ FROM docker.elastic.co/logstash/logstash-oss:${LOGSTASH_OSS_VERSION}
 # Example: RUN logstash-plugin install logstash-filter-json
 RUN logstash-plugin install logstash-codec-csv
 RUN logstash-plugin install logstash-output-zabbix
+RUN logstash-plugin install logstash-output-loki
 RUN logstash-plugin install --version=3.1.5 logstash-output-mongodb
diff --git a/logstash/pipeline/logstash.conf b/logstash/pipeline/logstash.conf
index 7f443b8..9dc5dc6 100644
--- a/logstash/pipeline/logstash.conf
+++ b/logstash/pipeline/logstash.conf
@@ -120,7 +120,12 @@ filter {
         target => "watcher_time_iso8601"
     }
     mutate {
-        add_field => { "protocol" => "ospf" }
+        add_field => {
+            "protocol" => "ospf"
+            "job" => "logstash"
+            "appname" => "topolograph-ospf"
+            "[@metadata][loki_item_value]" => "%{message}"
+        }
         remove_field => ["@version", "message"]
     }
 }
@@ -187,4 +192,11 @@ output {
             retry_failed => false
         }
     }
-}
\ No newline at end of file
+    if "${EXPORT_TO_LOKI_BOOL:False}" == "True" {
+        loki {
+            url => "${LOKI_URL}"
+            message_field => "[@metadata][loki_item_value]"
+            include_fields => ["appname", "job"]
+        }
+    }
+}