logs.alloy

// Pod Logs
discovery.kubernetes "pods" {
  role = "pod"
  selectors {
    role = "pod"
    field = "spec.nodeName=" + env("HOSTNAME")
  }
}

discovery.relabel "pod_logs" {
  targets = discovery.kubernetes.pods.targets
  rule {
    source_labels = ["__meta_kubernetes_namespace"]
    action = "replace"
    target_label = "namespace"
  }

  rule {
    source_labels = ["__meta_kubernetes_pod_name"]
    action = "replace"
    target_label = "pod"
  }
  rule {
    source_labels = ["__meta_kubernetes_pod_container_name"]
    action = "replace"
    target_label = "container"
  }
  rule {
    source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
    separator = "/"
    action = "replace"
    replacement = "$1"
    target_label = "job"
  }
  rule {
    source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
    separator = "/"
    action = "replace"
    replacement = "/var/log/pods/*$1/*.log"
    target_label = "__path__"
  }

  // set the container runtime as a label
  rule {
    action = "replace"
    source_labels = ["__meta_kubernetes_pod_container_id"]
    regex = "^(\\w+):\\/\\/.+$"
    replacement = "$1"
    target_label = "tmp_container_runtime"
  }
}

discovery.relabel "filtered_pod_logs" {
  targets = discovery.relabel.pod_logs.output
  rule {  // Drop anything with a "falsy" annotation value
    source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_logs_autogather"]
    regex = "(false|no|skip)"
    action = "drop"
  }
}

local.file_match "pod_logs" {
  path_targets = discovery.relabel.filtered_pod_logs.output
}

loki.source.file "pod_logs" {
  targets    = local.file_match.pod_logs.targets
  forward_to = [loki.process.pod_logs.receiver]
}

loki.process "pod_logs" {
  stage.match {
    selector = "{tmp_container_runtime=\"containerd\"}"
    // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
    stage.cri {}

    // Set the extract flags and stream values as labels
    stage.labels {
      values = {
        flags  = "",
        stream  = "",
      }
    }
  }

  // if the label tmp_container_runtime from above is docker parse using docker
  stage.match {
    selector = "{tmp_container_runtime=\"docker\"}"
    // the docker processing stage extracts the following k/v pairs: log, stream, time
    stage.docker {}

    // Set the extract stream value as a label
    stage.labels {
      values = {
        stream  = "",
      }
    }
  }

  // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have
  // cluster, namespace, pod, and container labels.
  // Also drop the temporary container runtime label as it is no longer needed.
  stage.label_drop {
    values = ["filename", "tmp_container_runtime"]
  }
  forward_to = [loki.process.logs_service.receiver]
}

// Logs Service
remote.kubernetes.secret "logs_service" {
  name = "loki-k8s-monitoring"
  namespace = "default"
}

loki.process "logs_service" {
  stage.static_labels {
      values = {
        cluster = "default-values-test",
      }
  }
  forward_to = [loki.write.logs_service.receiver]
}

// Loki
loki.write "logs_service" {
  endpoint {
    url = nonsensitive(remote.kubernetes.secret.logs_service.data["host"]) + "/loki/api/v1/push"
    tenant_id = nonsensitive(remote.kubernetes.secret.logs_service.data["tenantId"])

    basic_auth {
      username = nonsensitive(remote.kubernetes.secret.logs_service.data["username"])
      password = remote.kubernetes.secret.logs_service.data["password"]
    }
  }
}