This is documentation for the next version of Alloy. For the latest stable release, go to the latest version.

Documentation Grafana Alloy Reference Components loki loki.enrich

loki.enrich

EXPERIMENTAL: This is an experimental component. Experimental components are subject to frequent breaking changes, and may be removed with no equivalent replacement. The stability.level flag must be set to experimental to use the component.

The loki.enrich component enriches logs with additional labels from service discovery targets. It matches a label from incoming logs against a label from discovered targets, and copies specified labels from the matched target to the log entry.

Usage

alloy Copy

loki.enrich "<LABEL>" {
  // List of targets from a discovery component
  targets = <DISCOVERY_COMPONENT>.targets
  
  // Which label from discovered targets to match against
  match_label = "<LABEL>"
  
  // Which label from incoming logs to match against
  source_label = "<LABEL>"
  
  // List of labels to copy from discovered targets to logs
  labels_to_copy = ["<LABEL>", ...]
  
  // Where to send enriched logs
  forward_to = [<RECEIVER_LIST>]
}

Arguments

The following arguments are supported:

Blocks

The loki.enrich component doesn’t support any blocks. You can configure this component with arguments.

Exports

The following values are exported:

Example

alloy Copy

Expand code

// Configure HTTP discovery
discovery.http "default" {
    url = "http://network-inventory.example.com/prometheus_sd"
}

discovery.relabel "default" {
    targets = discovery.http.default.targets
    rule {
        action        = "replace"
        source_labels = ["__inventory_rack"]
        target_label  = "rack"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_datacenter"]
        target_label  = "datacenter"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_environment"]
        target_label  = "environment"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_tenant"]
        target_label  = "tenant"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_primary_ip"]
        target_label  = "primary_ip"
    }
}

// Receive syslog messages
loki.source.syslog "incoming" {
    listener {
        address = ":514"
        protocol = "tcp"
        labels = {
            job = "syslog"
        }
    }
    forward_to = [loki.enrich.default.receiver]
}

// Enrich logs using HTTP discovery
loki.enrich "default" {
    // Use targets from HTTP discovery (after relabeling)
    targets = discovery.relabel.default.output

    // Match hostname from logs to DNS name
    target_match_label = "primary_ip"

    forward_to = [loki.write.default.receiver]
}

Component Behavior

The component matches logs to discovered targets and enriches them with additional labels:

1. For each log entry, it looks up the value of logs_match_label from the log’s labels or target_match_label if logs_match_label is not specified.
2. It matches this value against the target_match_label in discovered targets.
3. If a match is found, it copies the requested labels_to_copy from the discovered target to the log entry. If labels_to_copy is empty, all labels are copied.
4. The log entry, enriched or unchanged, is forwarded to the configured receivers.

Compatible components

loki.enrich can accept arguments from the following components:

• Components that export Targets
• Components that export Loki LogsReceiver

loki.enrich has exports that can be consumed by the following components:

• Components that consume Loki LogsReceiver