Configuring Grafana Alloy to Output sane labels for rsyslog entries

Finally got around to hooking up my rsyslog server that consolidates all logs across the LAN with Alloy + Loki + Grafana. The alloy configuration was stupidly annoying – it looks like the code base is moving forward while leaving the documentation a bit behind. The task was fairly simply – try to get basic things like host, service, pid, severity fields into labels so queries are useful in grafana. AI was absolutely useless leading me into multiple blind alleys. Search also doesn’t really yield any good examples of this. Had to read the documentation and piece it together myself like I was in 2023 or something – sheesh!

Anyway, here’s my final working version of an Alloy config file that does what I want for my simple rsyslog -> Alloy -> Loki -> Grafana setup in terms of setting up labels:

logging {
  level = "warn"
}

// Configure a loki.write component to send logs to a local Loki instance.
loki.write "default" {
  endpoint {
    url = "http://localhost:3100/loki/api/v1/push"
  }
}

loki.relabel "syslog" {
  forward_to = []

  rule {
    action = "labelmap"
    regex = "__syslog_(.+)"
  }

  rule {
    action = "labelmap"
    regex  = "message_(.+)"
  }
}

// Configure a loki.source.syslog component to receive syslog messages.
loki.source.syslog "default" {
  listener {
    address = "0.0.0.0:1514"
    // Add a 'job' label to all logs received by this component.
    labels = {"job" = "syslog"}
  }

  relabel_rules = loki.relabel.syslog.rules

  // Forward received logs to the loki.write component.
  forward_to = [loki.write.default.receiver]
}