grafana - How to filter logs with ALERT keyword and label them with alert: ‘report’ in Promtail? - Stack Overflow

admin管理员组

文章数量:1278978

I tried to use Promtail to filter logs containing [ALERT] and add a label alert: "report" to those logs. For example, I wanted to filter logs containing [ALERT] and push them to Loki with an additional label. Here’s an example of the log:

2025-02-23 22:41:11.904 [http-nio-8001-exec-2] INFO  a.d.r.c.ReportOpenApiController - [ALERT] REPORT Request

To achieve this, I used the regex pipeline stage in Promtail to filter the logs and add the label alert: "report". Here is my configuration:

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: API-LOGS
    static_configs:
      - targets:
          - localhost
        labels:
          job: api-logs
          __path__: ./logs/api/*.log
    pipeline_stages:
      - regex:
          expression: '.*\[ALERT\].*'  # Only filter logs that contain [ALERT]
      - labels:
          alert: "report"  # Add the 'alert' label to the filtered logs

  - job_name: CRALWER-LOGS
    static_configs:
      - targets:
          - localhost
        labels:
          job: crawler-logs
          __path__: ./logs/crawler/*.log

pipeline_stages:
  - regex:
      expression: '.*\[ALERT\].*'
  - labels:
      alert: "report"

What I expected:

I expected to successfully filter logs containing [ALERT], add the label alert: "report", and have those logs pushed to Loki.

What actually happened:

However, the logs containing [ALERT] were not filtered, and the label alert: "report" was not added to those logs. The logs were sent to Loki without any filtering, and the label was not applied as expected.

I tried to filter logs that contain [ALERT] and add the label alert: "report" using the regex stage in Promtail’s configuration file. Here’s my configuration:

本文标签： grafanaHow to filter logs with ALERT keyword and label them with alert report’ in PromtailStack Overflow