docs: Replace deprecated Promtail with Grafana Alloy

[yanivagman]

1. Explain what the PR does

This PR resolves #5219 by comprehensively updating the "Accessing Tracee Logs" tutorial. The key changes include:

• Migration from Promtail to Grafana Alloy: Replaced all references and configurations for Promtail with Grafana Alloy, which is the recommended agent for collecting logs, metrics, and traces.
• Loki Helm Chart Update: Switched from the deprecated grafana/loki-distributed Helm chart to the modern grafana/loki chart (v3+), including updated configuration.
• Loki Datasource URL: Updated the Loki datasource URL in Grafana configuration to reflect the new Loki deployment.
• SSH Tunneling Instructions: Added a new section detailing how to access Grafana on remote servers using SSH port forwarding.
• Migration Guide: Included a guide for users who previously followed the legacy Promtail tutorial to migrate to Grafana Alloy and the new Loki setup.
• Documentation Cross-references: Updated related documentation links and navigation entries to reflect the change from Promtail to Grafana Alloy.

2. Explain how to test it

Follow the updated tutorial in docs/tutorials/promtail.md from start to finish.

1. Deploy Tracee using the Helm chart as described.
2. Deploy the observability stack (Grafana, Prometheus, Grafana Alloy, Loki) by applying the provided grafana-config.yaml, alloy-config.yaml, and loki-config.yaml files and installing the respective Helm charts.
3. Port-forward to Grafana: kubectl port-forward service/prom-grafana -n monitoring 3000:80.
4. Access Grafana at http://localhost:3000, log in, and navigate to the "Explore" section.
5. Select "Loki" as the data source and verify that Tracee logs can be queried (e.g., using {app="tracee"}).
6. (Optional) Test the SSH tunneling instructions if your cluster is on a remote server.

3. Other comments

• Fixes Replace deprecated Promtail with Grafana Alloy #5219
• References:
  • Migrate from Promtail to Grafana Alloy
  • Migrate from loki-distributed Helm chart

---

 

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}