syslog.alloy

loki.source.journal "syslog" {
  forward_to    = [loki.process.syslog.receiver]
  relabel_rules = loki.relabel.syslog.rules
  labels        = {
    component = "loki.source.journal",
    job       = "syslog",
  }
}

loki.relabel "syslog" {
  forward_to = []

  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label  = "unit"
  }

  rule {
    source_labels = ["__journal__hostname"]
    target_label  = "hostname"
  }
}

loki.process "syslog" {
  forward_to    = [loki.write.grafana_loki.receiver]

  stage.drop {
    source              = "unit"
    expression          = "user@.*.service"
    drop_counter_reason = "noisy"
  }

 stage.drop {
  expression          = ".*session closed for user.*"
  drop_counter_reason = "noisy"
 }
}