Caution
Grafana Alloy is the new name for our distribution of the OTel collector. Grafana Agent has been deprecated and is in Long-Term Support (LTS) through October 31, 2025. Grafana Agent will reach an End-of-Life (EOL) on November 1, 2025. Read more about why we recommend migrating to Grafana Alloy.
Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.
loki.source.journal
loki.source.journal
reads from the systemd journal and forwards them to other
loki.*
components.
Multiple loki.source.journal
components can be specified by giving them
different labels.
Usage
loki.source.journal "LABEL" {
forward_to = RECEIVER_LIST
}
Arguments
The component starts a new journal reader and fans out
log entries to the list of receivers passed in forward_to
.
loki.source.journal
supports the following arguments:
Name | Type | Description | Default | Required |
---|---|---|---|---|
format_as_json | bool | When true, log messages from the journal are passed through the pipeline as a JSON message with all of the journal entries’ original fields. When false, the log message is the text content of the MESSAGE field from the journal entry. | false | no |
max_age | duration | The oldest relative time from process start that will be read | "7h" | no |
path | string | Path to a directory to read entries from. Defaults to system paths (/var/log/journal and /run/log/journal) when empty. | "" | no |
matches | string | Journal matches to filter. Character (+) is not supported, only logical AND matches will be added. | "" | no |
forward_to | list(LogsReceiver) | List of receivers to send log entries to. | yes |
NOTE: A
job
label is added with the full name of the componentloki.source.journal.LABEL
.
Blocks
The following blocks are supported inside the definition of loki.source.journal
:
Hierarchy | Name | Description | Required |
---|---|---|---|
relabel_rules | relabel_rules | Relabeling rules to apply to received log entries. | no |
relabel_rules block
The rule
block contains the definition of any relabeling rules that can be
applied to an input metric. If more than one rule
block is defined, the
transformations are applied in top-down order.
The following arguments can be used to configure a rule
. All arguments are
optional. Omitted fields take their default values.
Name | Type | Description | Default | Required |
---|---|---|---|---|
source_labels | list(string) | The list of labels whose values are to be selected. Their content is concatenated using the separator and matched against regex . | no | |
separator | string | The separator used to concatenate the values present in source_labels . | ; | no |
regex | string | A valid RE2 expression with support for parenthesized capture groups. Used to match the extracted value from the combination of the source_label and separator fields or filter labels during the labelkeep/labeldrop/labelmap actions. | (.*) | no |
modulus | uint | A positive integer used to calculate the modulus of the hashed source label values. | no | |
target_label | string | Label to which the resulting value will be written to. | no | |
replacement | string | The value against which a regex replace is performed, if the regex matches the extracted value. Supports previously captured groups. | $1 | no |
action | string | The relabeling action to perform. | replace | no |
Here’s a list of the available actions, along with a brief description of their usage.
replace
- Matchesregex
to the concatenated labels. If there’s a match, it replaces the content of thetarget_label
using the contents of thereplacement
field.keep
- Keeps metrics whereregex
matches the string extracted using thesource_labels
andseparator
.drop
- Drops metrics whereregex
matches the string extracted using thesource_labels
andseparator
.hashmod
- Hashes the concatenated labels, calculates its modulomodulus
and writes the result to thetarget_label
.labelmap
- Matchesregex
against all label names. Any labels that match are renamed according to the contents of thereplacement
field.labeldrop
- Matchesregex
against all label names. Any labels that match are removed from the metric’s label set.labelkeep
- Matchesregex
against all label names. Any labels that don’t match are removed from the metric’s label set.
Finally, note that the regex capture groups can be referred to using either the
$CAPTURE_GROUP_NUMBER
or ${CAPTURE_GROUP_NUMBER}
notation.
Incoming messages have labels from the journal following the patten __journal_FIELDNAME
These labels are stripped unless a rule is created to retain the labels. An example rule is below.
rule {
action = "labelmap"
regex = "__journal_(.*)"
replacement = "journal_${1}"
}
Component health
loki.source.journal
is only reported as unhealthy if given an invalid
configuration.
Debug Metrics
agent_loki_source_journal_target_parsing_errors_total
(counter): Total number of parsing errors while reading journal messages.agent_loki_source_journal_target_lines_total
(counter): Total number of successful journal lines read.
Example
loki.source.journal "read" {
forward_to = [loki.write.endpoint.receiver]
}
loki.write "endpoint" {
endpoint {
url ="loki:3100/api/v1/push"
}
}