From aa2f562120e12fc6701993431609986c7912703d Mon Sep 17 00:00:00 2001 From: Erich Blume Date: Thu, 22 Jan 2026 17:08:26 -0800 Subject: [PATCH] Add logfmt parser for k8s log level extraction The JSON parser only works for JSON-formatted logs. Many Go services (Loki, Prometheus, etc.) use logfmt format. Add logfmt parser to extract level, caller, and component labels for better log filtering in Grafana. Co-Authored-By: Claude Opus 4.5 --- argocd/manifests/alloy-k8s/configmap.yaml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/argocd/manifests/alloy-k8s/configmap.yaml b/argocd/manifests/alloy-k8s/configmap.yaml index acc8ba5..232afef 100644 --- a/argocd/manifests/alloy-k8s/configmap.yaml +++ b/argocd/manifests/alloy-k8s/configmap.yaml @@ -89,7 +89,7 @@ data: expression = "v1 Endpoints is deprecated" } - // Try to parse JSON logs + // Try to parse JSON logs (e.g., structured app logs) stage.json { expressions = { level = "level", @@ -98,10 +98,22 @@ data: } } - // Extract level from parsed JSON if available + // Try to parse logfmt logs (e.g., Loki, Prometheus, Go services) + stage.logfmt { + mapping = { + level = "level", + ts = "ts", + caller = "caller", + component = "component", + } + } + + // Extract labels from parsed data (works for both JSON and logfmt) stage.labels { values = { - level = "", + level = "", + caller = "", + component = "", } } }