// Replaces Promtail in the old syslog-ng -> Promtail -> Loki path.
//
// DEPOT's fleet is not uniformly parseable as RFC3164: some RouterOS senders
// emit raw messages without a PRI/header. syslog-ng therefore keeps listening
// on the public stack ports and normalizes every message to RFC5424 before
// forwarding it here on the private stack network.

loki.relabel "syslog" {
  forward_to = []

  // Preserve the label used by the existing history and MikroTik dashboard.
  rule {
    source_labels = ["__syslog_message_hostname"]
    target_label  = "routerboard"
  }

  rule {
    source_labels = ["__syslog_message_severity"]
    target_label  = "severity"
  }

  rule {
    source_labels = ["__syslog_message_facility"]
    target_label  = "facility"
  }

  rule {
    source_labels = ["__syslog_connection_ip_address"]
    target_label  = "source_ip"
  }
}

loki.source.syslog "normalized_syslog" {
  listener {
    address       = "0.0.0.0:1514"
    protocol      = "tcp"
    syslog_format = "rfc5424"
    labels = {
      job       = "syslog",
      transport = "syslog-ng",
    }
  }

  relabel_rules = loki.relabel.syslog.rules
  forward_to    = [loki.write.default.receiver]
}

loki.write "default" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}