labels-scrape.alloy

/*
Module Components: labels_scrape
Description: Scrapes targets for logs based on Docker Containers labels

Following labels are available:
  logs.grafana.com/scrape: true

 allow containers to declare what tenant their logs should be written to,
 the following label is supported:

   logs.grafana.com/tenant: "primary"
*/

declare "labels_scrape" {

	/*****************************************************************
	* ARGUMENTS
	*****************************************************************/
	argument "forward_to" {
		comment = "Must be a list(LogsReceiver) where collected logs should be forwarded to"
	}

	argument "instance_name" {
		optional = true
	}

	argument "label_prefix" {
		comment  = "The label_prefix to use Auto-Scraping (default: logs.grafana.com)"
		default  = "logs.grafana.com"
		optional = true
	}

	argument "__sd_label" {
		optional = true
		comment  = "The logic is used to transform the label_prefix argument into a valid label name by removing unsupported characters."
		default  = string.replace(string.replace(string.replace(coalesce(argument.label_prefix.value, "logs.grafana.com"), ".", "_"), "/", "_"), "-", "_")
	}

	argument "cluster" {
		optional = true
		default  = "docker-compose"
	}

	argument "namespace" {
		optional = true
		default  = "monitoring-system"
	}

	argument "tenant" {
		comment  = "The tenant to write logs to.  This does not have to be the tenantId, this is the value to look for in the logs.grafana.com/tenant label, and this can be a regex. (default: (.*))"
		optional = true
		default  = "(.*)"
	}

	// find all containers
	discovery.docker "dd_logs" {
		host             = "unix:///var/run/docker.sock"
		refresh_interval = "30s"

		filter {
			name   = "status"
			values = ["running"]
		}
	}

	// filter logs by docker compose labels
	discovery.relabel "label_logs_filter" {
		targets = discovery.docker.dd_logs.targets

		// allow resources to declare their metrics scraped or not
		// Example Annotation:
		//   logs.grafana.com/scrape: false
		rule {
			action        = "replace"
			source_labels = [
				"__meta_docker_container_label_" + argument.__sd_label.value + "_scrape",
			]
			separator    = ";"
			regex        = "^(?:;*)?(true|false).*$"
			replacement  = "$1"
			target_label = "__tmp_scrape"
		}

		// drop any targets that have scrape: false
		rule {
			action        = "drop"
			source_labels = ["__tmp_scrape"]
			regex         = "false"
		}

		// allow resources to declare their metrics the tenant their metrics should be sent to,
		// Example Annotation:
		//   logs.grafana.com/tenant: primary
		rule {
			action        = "keep"
			source_labels = [
				"__meta_docker_container_label_" + argument.__sd_label.value + "_tenant",
			]
			regex = "^(" + argument.tenant.value + ")$"
		}

		// set a default job label to be the namespace/service_name
		rule {
			action        = "replace"
			source_labels = [
				"__meta_docker_container_label_com_docker_compose_service",
			]
			regex        = "^(?:;*)?([^;]+).*$"
			replacement  = argument.namespace.value + "/$1"
			target_label = "job"
		}

		// allow resources to declare their the job label value to use when collecting their logs, the default value is "",
		rule {
			action        = "replace"
			source_labels = [
				"__meta_docker_container_label_" + argument.__sd_label.value + "_job",
			]
			separator    = ";"
			regex        = "^(?:;*)?([^;]+).*$"
			replacement  = "$1"
			target_label = "job"
		}

		rule {
			source_labels = ["__meta_docker_container_name"]
			regex         = "/(.*)"
			target_label  = "pod"
		}

		rule {
			source_labels = ["__meta_docker_container_name"]
			regex         = "/(.*)"
			target_label  = "container"
		}

		rule {
			action        = "replace"
			source_labels = [
				"__meta_docker_container_label_com_docker_compose_service",
			]
			regex        = "^(?:;*)?([^;]+).*$"
			replacement  = "$1"
			target_label = "app"
		}

		rule {
			action        = "replace"
			source_labels = [
				"__meta_docker_container_label_app",
			]
			regex        = "^(?:;*)?([^;]+).*$"
			replacement  = "$1"
			target_label = "app"
		}

		// make all labels on the pod available to the pipeline as labels(for loki process),
		// they are omitted before write via label allow unless explicitly set
		rule {
			action = "labelmap"
			regex  = "__meta_docker_container_label_(.+)"
		}

		/********************************************
		* Handle Setting Common Labels
		********************************************/
		rule {
			action       = "replace"
			replacement  = argument.cluster.value
			target_label = "cluster"
		}

		rule {
			action       = "replace"
			replacement  = argument.namespace.value
			target_label = "namespace"
		}

		rule {
			replacement  = "docker"
			target_label = "tmp_container_runtime"
		}
	}

	loki.source.docker "lsd_docker_logs" {
		host          = "unix:///var/run/docker.sock"
		targets       = discovery.relabel.label_logs_filter.output
		relabel_rules = discovery.relabel.label_logs_filter.rules

		labels     = {"source" = "docker"}
		forward_to = [loki.process.parse.receiver]
	}

	// parse the log based on the container runtime
	loki.process "parse" {
		forward_to = argument.forward_to.value
		/*******************************************************************************
		*                         Container Runtime Parsing
		********************************************************************************/
		// if the label tmp_container_runtime from above is containerd parse using cri
		stage.match {
			selector = "{tmp_container_runtime=\"containerd\"}"
			// the cri processing stage extracts the following k/v pairs: log, stream, time, flags
			stage.cri { }

			// Set the extract flags and stream values as labels
			stage.labels {
				values = {
					flags  = "",
					stream = "",
				}
			}
		}

		// if the label tmp_container_runtime from above is docker parse using docker
		stage.match {
			selector = "{tmp_container_runtime=\"docker\"}"
			// the docker processing stage extracts the following k/v pairs: log, stream, time
			stage.docker { }

			// Set the extract stream value as a label
			stage.labels {
				values = {
					stream = "",
				}
			}
		}

		// drop the temporary container runtime label as it is no longer needed
		stage.label_drop {
			values = ["tmp_container_runtime"]
		}
	}
}