logginglabelpromtail

Drop 'filename' label before sending to Loki with Promtail


I have a promtail configuration to scrape all .log files from a directory.

    - job_name: kubernetes-audit-log
      static_configs:
      - targets:
          - localhost
        labels:
          __path__: /var/log/kubernetes/audit/*.log
          job: kubernetes-audit

The name of the files looks like this:

audit-2023-09-21T10-18-23.143.log
audit-2023-09-21T11-06-34.856.log
audit-2023-09-21T11-50-04.019.log
audit-2023-09-21T12-38-31.858.log
audit-2023-09-21T13-28-14.617.log

I want promtail to parse them and send them to a Loki instance. This works fine however I'm not interested in the filename label that is being generated from __path__. I want a single job=kuberntes-audit where I can find all my log entries.

How can I remove the label before sending the logs to Loki?

I tried to use relabel_config and drop them but it didn`t work:

    - job_name: kubernetes-audit-log
      static_configs:
      - targets:
          - localhost
        labels:
          __path__: /var/log/kubernetes/audit/*.log
          job: kubernetes-audit
      relabel_configs:
      - action: labeldrop
        regex: filename

Solution

  • - job_name: kubernetes-audit-log
      static_configs:
      - targets:
          - localhost
        labels:
          __path__: /var/log/kubernetes/audit/*.log
          job: kubernetes-audit
      pipeline_stages:
      - labeldrop:
        - filename
    

    Works. The relabel_config I tried before did not.