This is documentation for the next version of Grafana Alloy Documentation. For the latest stable release, go to the latest version.

Documentation Grafana Alloy Reference Components loki loki.enrich

loki.enrich

The loki.enrich component enriches logs with additional labels from service discovery targets. It matches labels from incoming logs against labels from discovered targets, and copies specified labels from the matched target to the log entry. If no match occurs, the component forwards the log entry unchanged.

Use the target_to_log_match argument to specify which target labels correspond to which log labels. The map keys are target label names and the values are the corresponding log label names. All labels in the map must match for enrichment to occur.

Usage

Alloy Copy

loki.enrich "<LABEL>" {
  targets = <DISCOVERY_COMPONENT>.targets

  target_to_log_match = {
    "<TARGET_LABEL_1>" = "<LOG_LABEL_1>",
    "<TARGET_LABEL_2>" = "<LOG_LABEL_2>",
  }

  labels_to_copy = ["<LABEL>", ...]

  forward_to = [<RECEIVER_LIST>]
}

Arguments

You can use the following arguments with loki.enrich:

The target_to_log_match map must contain at least one entry. The keys and values can’t be empty strings.

Blocks

The loki.enrich component doesn’t support any blocks. You can configure this component with arguments.

Exports

The following values are exported:

Example

The following example enriches syslog entries with labels from an HTTP service discovery target. It matches the connection IP address and tenant label before it forwards entries to Loki.

Alloy Copy

// Configure HTTP discovery
discovery.http "default" {
    url = "http://network-inventory.example.com/prometheus_sd"
}

discovery.relabel "default" {
    targets = discovery.http.default.targets
    rule {
        action        = "replace"
        source_labels = ["__inventory_rack"]
        target_label  = "rack"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_datacenter"]
        target_label  = "datacenter"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_environment"]
        target_label  = "environment"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_tenant"]
        target_label  = "tenant"
    }
    rule {
        action        = "replace"
        source_labels = ["__inventory_primary_ip"]
        target_label  = "primary_ip"
    }
}

loki.relabel "syslog" {
    forward_to = []

    rule {
        source_labels = ["__syslog_connection_ip_address"]
        target_label  = "source_ip"
    }
}

// Receive syslog messages
loki.source.syslog "incoming" {
    listener {
        address  = ":514"
        protocol = "tcp"
        labels   = {
            job    = "syslog",
            tenant = "production",
        }
    }

    relabel_rules = loki.relabel.syslog.rules
    forward_to    = [loki.enrich.default.receiver]
}

// Enrich logs using HTTP discovery
loki.enrich "default" {
    // Use targets from HTTP discovery (after relabeling)
    targets = discovery.relabel.default.output

    target_to_log_match = {
        "primary_ip" = "source_ip",
        "tenant"     = "tenant",
    }

    forward_to = [loki.write.default.receiver]
}

loki.write "default" {
    endpoint {
        url = "http://loki:3100/loki/api/v1/push"
    }
}

Component behavior

The component matches logs to discovered targets and enriches them with additional labels:

1. For each log entry, it looks up the log labels specified by target_to_log_match.
2. It matches those values against the corresponding target labels. All label pairs must match the same target.
3. If a match is found, it copies the requested labels_to_copy from the discovered target to the log entry. If labels_to_copy is empty, all labels are copied.
4. The log entry, enriched or unchanged, is forwarded to the configured receivers.

The component handles the following cases:

• If no target matches a log entry, the component forwards the log entry unchanged.
• If a log entry is missing any of the labels in target_to_log_match, or any of those labels has an empty value, the component forwards the log entry unchanged.
• If a target is missing any of the matching labels, or any of them has an empty value, the component ignores that target.
• If multiple targets have the same values for all matching labels, the component uses the last of those targets in the targets list. The discovery component determines the order of targets, and the order can change between updates. To get predictable results, make sure the matching labels identify a single target.

Compatible components

loki.enrich can accept arguments from the following components:

• Components that export Targets
• Components that export Loki LogsReceiver

loki.enrich has exports that can be consumed by the following components:

• Components that consume Loki LogsReceiver