.

loki/README.md

@@ -3,3 +3,7 @@
 Loki is a horizontally scalable, highly available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log stream.
 
 There is a collector agent (Alloy)
+
+We get Proxmox logs from Alloy (installed on each proxmox)
+We get flatcar logs from a deamon set that runs on each flatcar VM (but relabel doesnt work yet)
+We get kubernetes logs,(i think also from the flatcar DS ?)

loki/alloy-external-syslog.yaml

@@ -12,11 +12,16 @@ data:
 
     loki.source.syslog "external_tcp" {
       listener {
-        address  = "0.0.0.0:1514"
-        protocol = "tcp"
+        address                          = "0.0.0.0:1514"
+        protocol                         = "tcp"
+        syslog_format                    = "rfc3164"
+        use_incoming_timestamp           = true
+        rfc3164_default_to_current_year  = true
+
         labels = {
-          job    = "syslog",
-          source = "external",
+          job    = "syslog"
+          source = "external"
+          role   = "network"
         }
       }
 
@@ -25,11 +30,16 @@ data:
 
     loki.source.syslog "external_udp" {
       listener {
-        address  = "0.0.0.0:1514"
-        protocol = "udp"
+        address                          = "0.0.0.0:1514"
+        protocol                         = "udp"
+        syslog_format                    = "rfc3164"
+        use_incoming_timestamp           = true
+        rfc3164_default_to_current_year  = true
+
         labels = {
-          job    = "syslog",
-          source = "external",
+          job    = "syslog"
+          source = "external"
+          role   = "network"
         }
       }