.

loki/alloy-external-syslog.yaml

@@ -12,26 +12,38 @@ data:
 
     loki.source.syslog "external_tcp" {
       listener {
-        address = "0.0.0.0:1514"
+        address  = "0.0.0.0:1514"
         protocol = "tcp"
         labels = {
-          job      = "syslog",
-          protocol = "tcp",
-          source   = "external",
+          job = "syslog"
+          source = "external"
         }
       }
 
-      forward_to = [loki.write.default.receiver]
+      forward_to = [loki.process.syslog_labels.receiver]
     }
 
     loki.source.syslog "external_udp" {
       listener {
-        address = "0.0.0.0:1514"
+        address  = "0.0.0.0:1514"
         protocol = "udp"
         labels = {
-          job      = "syslog",
-          protocol = "udp",
-          source   = "external",
+          job = "syslog"
+          source = "external"
+        }
+      }
+
+      forward_to = [loki.process.syslog_labels.receiver]
+    }
+
+    loki.process "syslog_labels" {
+
+      stage.labels {
+        values = {
+          hostname = "__syslog_message_hostname"
+          app      = "__syslog_message_app_name"
+          severity = "__syslog_message_severity"
+          facility = "__syslog_message_facility"
         }
       }