From e6de7ba391a16dfe6c24cfdce95f1b02942528fd Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Thu, 22 Jan 2026 18:00:34 -0800
Subject: [PATCH] Fix Alloy logfmt decode errors for JSON logs (#46)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary
- Use `stage.match` to conditionally apply logfmt parsing only to lines that don't start with `{`
- This prevents error spam like `"failed to decode logfmt" component_path=/ component_id=loki.process.pods component=stage type=logfmt err="logfmt syntax error at pos 2 on line 1: unexpected '\"'"` when JSON-formatted logs hit the logfmt parser

## Deployment and Testing
- [ ] Sync alloy-k8s app to feature branch and verify errors stop appearing
- [ ] Verify JSON logs are still parsed correctly
- [ ] Verify logfmt logs (from Loki, Prometheus etc.) are still parsed correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/46
---
 argocd/manifests/alloy-k8s/configmap.yaml | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/argocd/manifests/alloy-k8s/configmap.yaml b/argocd/manifests/alloy-k8s/configmap.yaml
index 92c8ab9..f7230af 100644
--- a/argocd/manifests/alloy-k8s/configmap.yaml
+++ b/argocd/manifests/alloy-k8s/configmap.yaml
@@ -102,18 +102,22 @@ data:
         }
       }
 
-      // Try to parse logfmt logs (e.g., Loki, Prometheus, Go services)
-      // Silently skip lines that aren't valid logfmt
-      stage.logfmt {
-        mapping = {
-          level     = "level",
-          ts        = "ts",
-          caller    = "caller",
-          component = "component",
+      // Try to parse logfmt logs, but only for non-JSON lines
+      // This prevents noisy decode errors when JSON logs hit the logfmt parser
+      stage.match {
+        selector = "{namespace=~\".+\"} |~ \"^[^{]\"" // Lines not starting with '{'
+
+        stage.logfmt {
+          mapping = {
+            level     = "level",
+            ts        = "ts",
+            caller    = "caller",
+            component = "component",
+          }
         }
       }
 
-      // Drop the logfmt error label if parsing failed (prevents noisy errors)
+      // Drop any error labels from parsing attempts (both JSON and logfmt)
       stage.label_drop {
         values = ["__error__", "__error_details__"]
       }