Parse RFC3164 (BSD) syslog in Alloy — real devices don't send RFC5424

Confirmed via packet capture: a Yealink phone and (per RouterOS's known
default behavior) the fleet's routers send classic BSD-style syslog,
not RFC5424. Alloy's loki.source.syslog defaults to RFC5424-only and
was silently dropping every message ("expecting a version value in the
range 1-999"). syslog_format = "rfc3164" fixes it, but that argument
only exists from Alloy v1.5.0 onward (confirmed empirically against
v1.4.3, which fails config load) — bump the pin accordingly. v1.5.0 is
an adjacent minor release, not the kind of large version jump that hit
the Loki/Grafana :latest kernel-incompatibility bug fixed earlier.

logging/alloy-config.alloy

@@ -29,10 +29,17 @@ loki.relabel "syslog" {
   }
 }
 
+// syslog_format is "rfc3164" (legacy BSD syslog, no version field) rather
+// than the component's rfc5424 default — confirmed by packet capture that
+// both the Yealink phones and RouterOS routers send rfc3164 in practice.
+// A listener can only parse one format; if a device ever sends genuine
+// rfc5424, it needs its own listener on a different port.
+
 loki.source.syslog "network_devices_udp" {
   listener {
-    address  = "0.0.0.0:514"
-    protocol = "udp"
+    address       = "0.0.0.0:514"
+    protocol      = "udp"
+    syslog_format = "rfc3164"
     labels = {
       job       = "syslog",
       transport = "udp",
@@ -45,8 +52,9 @@ loki.source.syslog "network_devices_udp" {
 
 loki.source.syslog "network_devices_tcp" {
   listener {
-    address  = "0.0.0.0:1514"
-    protocol = "tcp"
+    address       = "0.0.0.0:1514"
+    protocol      = "tcp"
+    syslog_format = "rfc3164"
     labels = {
       job       = "syslog",
       transport = "tcp",

logging/docker-compose.yaml

@@ -16,8 +16,10 @@ services:
       - logging-nw
 
   alloy:
-    # Pinned for the same reason as loki — see comment there.
-    image: grafana/alloy:v1.4.3
+    # Pinned for the same reason as loki — see comment there. v1.5.0
+    # specifically (not v1.4.3) because it's the first release with
+    # syslog_format = "rfc3164" support, needed below.
+    image: grafana/alloy:v1.5.0
     container_name: alloy
     command:
       - run