From 7a4719ed0cace3ccabb5530d4e6c41bf0a2f47e8 Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Wed, 25 Feb 2026 21:57:46 -0800
Subject: [PATCH] Fix numeric log levels showing as errors in Grafana

1Password Connect uses numeric log levels (1=error, 2=warn, 3=info,
4=debug) which Grafana's logs panel doesn't recognize, rendering all
lines with error styling. Add stage.replace rules in both Alloy
configs (indri + ringtail) to map numeric levels to standard strings.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 argocd/manifests/alloy-k8s/config.alloy      | 23 ++++++++++++++++++++
 argocd/manifests/alloy-ringtail/config.alloy | 23 ++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/argocd/manifests/alloy-k8s/config.alloy b/argocd/manifests/alloy-k8s/config.alloy
index 86c0747..5aec0c5 100644
--- a/argocd/manifests/alloy-k8s/config.alloy
+++ b/argocd/manifests/alloy-k8s/config.alloy
@@ -109,6 +109,29 @@ loki.process "pods" {
     }
   }
 
+  // Map numeric log levels (e.g. 1Password Connect: 1=error,2=warn,3=info,4=debug)
+  // to standard strings so Grafana logs panel colors them correctly
+  stage.replace {
+    source     = "level"
+    expression = "^1$"
+    replace    = "error"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^2$"
+    replace    = "warn"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^3$"
+    replace    = "info"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^4$"
+    replace    = "debug"
+  }
+
   // Add cluster label for multi-cluster identification
   stage.static_labels {
     values = { cluster = "indri" }
diff --git a/argocd/manifests/alloy-ringtail/config.alloy b/argocd/manifests/alloy-ringtail/config.alloy
index 9ae8981..61eb75e 100644
--- a/argocd/manifests/alloy-ringtail/config.alloy
+++ b/argocd/manifests/alloy-ringtail/config.alloy
@@ -147,6 +147,29 @@ loki.process "pods" {
     }
   }
 
+  // Map numeric log levels (1Password Connect uses 1=error,2=warn,3=info,4=debug)
+  // to standard strings so Grafana logs panel colors them correctly
+  stage.replace {
+    source     = "level"
+    expression = "^1$"
+    replace    = "error"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^2$"
+    replace    = "warn"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^3$"
+    replace    = "info"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^4$"
+    replace    = "debug"
+  }
+
   // Add cluster label for multi-cluster identification
   stage.static_labels {
     values = { cluster = "ringtail" }