66 lines
1.4 KiB
Plaintext
66 lines
1.4 KiB
Plaintext
// Direct replacement for the old syslog-ng -> Promtail -> Loki path.
|
|
//
|
|
// Existing RouterOS senders target 185.108.4.158:514/udp and use classic
|
|
// BSD/RFC3164 framing. TCP/601 is retained for RFC5424-capable senders.
|
|
|
|
loki.relabel "syslog" {
|
|
forward_to = []
|
|
|
|
// Preserve the label used by the existing history and MikroTik dashboard.
|
|
rule {
|
|
source_labels = ["__syslog_message_hostname"]
|
|
target_label = "routerboard"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_severity"]
|
|
target_label = "severity"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_facility"]
|
|
target_label = "facility"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_connection_ip_address"]
|
|
target_label = "source_ip"
|
|
}
|
|
}
|
|
|
|
loki.source.syslog "network_devices_udp" {
|
|
listener {
|
|
address = "0.0.0.0:514"
|
|
protocol = "udp"
|
|
syslog_format = "rfc3164"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "udp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.source.syslog "network_devices_tcp" {
|
|
listener {
|
|
address = "0.0.0.0:601"
|
|
protocol = "tcp"
|
|
syslog_format = "rfc5424"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "tcp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
url = "http://loki:3100/loki/api/v1/push"
|
|
}
|
|
}
|