Support for Log Transformations in vlagent

[vadimalekseev]

Is your feature request related to a problem? Please describe

Currently, vlagent cannot transform or filter logs before sending them to remoteWrite targets. This creates several limitations:

• Unstructured logs cannot be normalized or parsed before ingestion.
• Users cannot filter out unnecessary logs (e.g., debug noise, specific namespaces).
• It's not possible to enrich logs with additional fields.
• Routing logs based on conditions (e.g., sending only errors to a specific remoteWrite) requires external tools.
• Per-target transformation logic is not supported, making multi-destination log pipelines inflexible.

Describe the solution you'd like

Introduce a log-transformation pipeline in vlagent that processes logs before sending them to remoteWrite. The transformations should use the existing LogsQL language for filtering, parsing, modifying and routing logs.

Details are available in the document (work in progress): https://docs.google.com/document/d/1gSw2OarAiEJXSHZ170qnjTCi_aOV5e64H-CVXU9gK8c

Key capabilities requested:

• Apply a chain of transformations to all incoming logs.
• Support LogsQL filters and pipe operations (e.g., unpack_json, delete, replace_regexp, format, drop).
• Allow both global and per-remote transformation configurations.

Describe alternatives you've considered

No response

Additional information

No response