Add loki plugin in logstash and add configuration to use it.

.env.template

@@ -40,4 +40,6 @@ WEBHOOK_PORT=8081
 WEBHOOK_URI=/
 WEBHOOK_TLS_ON=off
 SSH_COMMAND_READ_TIMEOUT=60
-EXPORT_TO_TOPOLOGRAPH_SOCKET=True
+EXPORT_TO_TOPOLOGRAPH_SOCKET=True
+EXPORT_TO_LOKI_BOOL=False
+LOKI_URL=http://loki.local:3100/loki/api/v1/push

README.md

@@ -83,6 +83,10 @@ If a subnet was removed from OSPF node (the node withdrew it from the announceme
 HTTP POST messages can be easily accepted by messengers, which allows to get instant notifications of OSPF topology changes:
 ![](docs/slack/slack_notification.PNG)
 
+## Push IS-IS topology changes to loki
+
+You can configure [loki](https://grafana.com/oss/loki/) to send topology changes. Simply edit `.env` and adapt `EXPORT_TO_LOKI_BOOL` and `LOKI_URL`. 
+
 ## Quick lab
 #### Containerlab
 Here is a lab for tracking OSPF topology changes placed here **containerlab/frr01**. Watcher logs:  

docker-compose.yml

@@ -40,6 +40,8 @@ services:
       EXPORT_TO_TOPOLOGRAPH_SOCKET: $EXPORT_TO_TOPOLOGRAPH_SOCKET
       TOPOLOGRAPH_HOST: $TOPOLOGRAPH_HOST
       TOPOLOGRAPH_PORT: $TOPOLOGRAPH_PORT
+      EXPORT_TO_LOKI_BOOL: $EXPORT_TO_LOKI_BOOL
+      LOKI_URL: $LOKI_URL
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:9600"]
       interval: 5s

logstash/Dockerfile

@@ -7,4 +7,5 @@ FROM docker.elastic.co/logstash/logstash-oss:${LOGSTASH_OSS_VERSION}
 # Example: RUN logstash-plugin install logstash-filter-json
 RUN logstash-plugin install logstash-codec-csv
 RUN logstash-plugin install logstash-output-zabbix
+RUN logstash-plugin install logstash-output-loki
 RUN logstash-plugin install --version=3.1.5 logstash-output-mongodb

logstash/pipeline/logstash.conf

@@ -120,7 +120,12 @@ filter {
         target => "watcher_time_iso8601"
     }
     mutate {
-        add_field => { "protocol" => "ospf" }
+        add_field => {
+            "protocol" => "ospf"
+            "job" => "logstash"
+            "appname" => "topolograph-ospf"
+            "[@metadata][loki_item_value]" => "%{message}"
+        }
         remove_field => ["@version", "message"]
     }
 }
@@ -187,4 +192,11 @@ output {
             retry_failed => false
         }
     }
-}
+    if "${EXPORT_TO_LOKI_BOOL:False}" == "True" {
+        loki {
+            url => "${LOKI_URL}"
+            message_field => "[@metadata][loki_item_value]"
+            include_fields => ["appname", "job"]
+        }
+    }
+}