pipistrello
22dfb732d3
Alloy receives syslog on 514/udp and 1514/tcp from network devices, forwards to a local Loki instance; Grafana provisioned with Loki as default datasource. Compose bind-mounts config from /mnt/containers/logging/... on the host (staged separately) since Portainer's GitOps pull only fetches the compose file, not the repo's other files.
65 lines
1.3 KiB
Plaintext
65 lines
1.3 KiB
Plaintext
// Receives syslog from routers, switches, and Yealink phones on this host's
|
|
// LAN interface, tags each message with useful labels, and ships it to the
|
|
// local Loki instance.
|
|
//
|
|
// Point network devices at this host's IP, port 514/udp (or 1514/tcp for
|
|
// devices that only speak TCP framing).
|
|
|
|
loki.relabel "syslog" {
|
|
forward_to = []
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_hostname"]
|
|
target_label = "hostname"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_severity"]
|
|
target_label = "severity"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_facility"]
|
|
target_label = "facility"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_connection_ip_address"]
|
|
target_label = "source_ip"
|
|
}
|
|
}
|
|
|
|
loki.source.syslog "network_devices_udp" {
|
|
listener {
|
|
address = "0.0.0.0:514"
|
|
protocol = "udp"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "udp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.source.syslog "network_devices_tcp" {
|
|
listener {
|
|
address = "0.0.0.0:1514"
|
|
protocol = "tcp"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "tcp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
url = "http://loki:3100/loki/api/v1/push"
|
|
}
|
|
}
|