From 14e931591bd20da54810e9d75aa33bd640294e6a Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Sat, 7 Mar 2026 13:57:04 -0800
Subject: [PATCH] Fix 1Password Connect numeric log levels misclassified in
 Grafana (#287)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary
- 1Password Connect uses non-standard numeric log levels (`1`=error, `2`=warn, `3`=info, `4`=debug, `5`=trace) per [1Password/connect#44](https://github.com/1Password/connect/issues/44)
- Alloy extracts the `level` JSON field as-is, so info-level health checks get `level="3"` in Loki
- Grafana expects string level labels — numeric values are unrecognized, causing misclassified log severity/coloring
- Adds a `stage.match` + `stage.template` in the Alloy pipeline scoped to `{namespace="1password"}` to normalize numeric levels to standard strings
- Other services are completely unaffected (scoped by namespace, not global)

## Deployment and Testing
- [ ] Sync alloy-k8s from branch: `argocd app set alloy-k8s --revision fix/onepassword-numeric-log-levels && argocd app sync alloy-k8s`
- [ ] Wait ~2 minutes for new logs to flow
- [ ] Verify level labels: `curl -sG "http://localhost:3100/loki/api/v1/label/level/values" --data-urlencode 'query={namespace="1password"}'` should show `"info"` and `"warn"` instead of `"3"` and `"2"`
- [ ] Check Grafana log panel for 1password namespace — logs should no longer appear as errors
- [ ] After merge: `argocd app set alloy-k8s --revision main && argocd app sync alloy-k8s`

Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/287
---
 argocd/manifests/alloy-k8s/config.alloy              | 12 ++++++++++++
 argocd/manifests/alloy-ringtail/config.alloy         | 12 ++++++++++++
 .../fix-onepassword-numeric-log-levels.bugfix.md     |  1 +
 3 files changed, 25 insertions(+)
 create mode 100644 docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md

diff --git a/argocd/manifests/alloy-k8s/config.alloy b/argocd/manifests/alloy-k8s/config.alloy
index 86c0747..c169c93 100644
--- a/argocd/manifests/alloy-k8s/config.alloy
+++ b/argocd/manifests/alloy-k8s/config.alloy
@@ -100,6 +100,18 @@ loki.process "pods" {
     values = ["__error__", "__error_details__"]
   }
 
+  // Normalize 1password-connect numeric log levels to strings (1=error..5=trace)
+  // Scoped to the 1password namespace so other services are unaffected.
+  // See: https://github.com/1Password/connect/issues/44
+  stage.match {
+    selector = "{namespace=\"1password\"}"
+
+    stage.template {
+      source   = "level"
+      template = "{{ if eq .Value \"1\" }}error{{ else if eq .Value \"2\" }}warn{{ else if eq .Value \"3\" }}info{{ else if eq .Value \"4\" }}debug{{ else if eq .Value \"5\" }}trace{{ else }}{{ .Value }}{{ end }}"
+    }
+  }
+
   // Extract labels from parsed JSON data
   stage.labels {
     values = {
diff --git a/argocd/manifests/alloy-ringtail/config.alloy b/argocd/manifests/alloy-ringtail/config.alloy
index 9ae8981..c63b478 100644
--- a/argocd/manifests/alloy-ringtail/config.alloy
+++ b/argocd/manifests/alloy-ringtail/config.alloy
@@ -139,6 +139,18 @@ loki.process "pods" {
     values = ["__error__", "__error_details__"]
   }
 
+  // Normalize 1password-connect numeric log levels to strings (1=error..5=trace)
+  // Scoped to the 1password namespace so other services are unaffected.
+  // See: https://github.com/1Password/connect/issues/44
+  stage.match {
+    selector = "{namespace=\"1password\"}"
+
+    stage.template {
+      source   = "level"
+      template = "{{ if eq .Value \"1\" }}error{{ else if eq .Value \"2\" }}warn{{ else if eq .Value \"3\" }}info{{ else if eq .Value \"4\" }}debug{{ else if eq .Value \"5\" }}trace{{ else }}{{ .Value }}{{ end }}"
+    }
+  }
+
   // Extract labels from parsed JSON data
   stage.labels {
     values = {
diff --git a/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md b/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md
new file mode 100644
index 0000000..74f2a99
--- /dev/null
+++ b/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md
@@ -0,0 +1 @@
+Fix 1Password Connect logs showing as errors in Grafana by normalizing numeric log levels (1-5) to standard strings (error/warn/info/debug/trace) in the Alloy log processing pipeline.