134 lines
3.4 KiB
YAML
134 lines
3.4 KiB
YAML
server:
|
|
disable: true
|
|
|
|
positions:
|
|
filename: /var/opt/promtail/promtail_syslog_position.yaml
|
|
|
|
clients:
|
|
- url: http://<%= @LOKIENDPOINT %>/loki/api/v1/push
|
|
|
|
scrape_configs:
|
|
- job_name: syslog
|
|
static_configs:
|
|
- targets:
|
|
- localhost
|
|
labels:
|
|
job: syslog
|
|
__path__: /var/log/vector/*.log
|
|
|
|
pipeline_stages:
|
|
- json:
|
|
expressions:
|
|
appname:
|
|
hostname:
|
|
level: severity
|
|
message:
|
|
timestamp:
|
|
|
|
- labels:
|
|
appname:
|
|
hostname:
|
|
level:
|
|
|
|
- match:
|
|
selector: '{job="syslog", level=~"(debug|DEBUG)"}'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname=~"(storageRM|sdrsInjector)"} |= "getting state for"'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="Hostd"} |~ "(->|IpmiIfcOpenIpmiOpen|LikewiseGetDomainJoinInfo|AddVirtualMachine: VM|Solo.HttpSvc.HTTPService|VigorCallback received fault|vim.fault.InvalidPowerState|Unable to get resource settings for a powered on VM|VigorOnlineStatusCb|N7Vmacore16TimeoutExceptionE)"'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="smartd"} |~ "(REALLOCATED SECTOR CT below threshold)"'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="backup.sh"} |~ "(esx.conf|Creating archive)"'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="Rhttpproxy"} |~ "(warning rhttpproxy|->)"'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="usbarb", level="notice"}'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new", appname="vmauthd", level="notice"}'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="esxi-new"}'
|
|
stages:
|
|
- timestamp:
|
|
source: timestamp
|
|
format: 2006-01-02T15:04:05.999Z
|
|
location: Etc/GMT
|
|
|
|
- template:
|
|
source: level
|
|
template: '{{ regexReplaceAllLiteral "err" .Value "error" }}'
|
|
|
|
- labeldrop:
|
|
- appname
|
|
|
|
- output:
|
|
source: message
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="ubnt", appname="openvpn", level="notice"}'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="ubnt", appname="sudo", level="info"}'
|
|
action: drop
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="ubnt"}'
|
|
stages:
|
|
- timestamp:
|
|
source: timestamp
|
|
format: 2006-01-02T15:04:05.999Z
|
|
location: Asia/Bangkok
|
|
|
|
- template:
|
|
source: level
|
|
template: '{{ regexReplaceAllLiteral "err" .Value "error" }}'
|
|
|
|
- labels:
|
|
level:
|
|
hostname:
|
|
|
|
- labeldrop:
|
|
- appname
|
|
|
|
- output:
|
|
source: message
|
|
|
|
- match:
|
|
selector: '{job="syslog", hostname="ds418"}'
|
|
stages:
|
|
- timestamp:
|
|
source: timestamp
|
|
format: 2006-01-02T15:04:05.999Z
|
|
location: Asia/Bangkok
|
|
|
|
- template:
|
|
source: level
|
|
template: '{{ regexReplaceAllLiteral "err" .Value "error" }}'
|
|
|
|
- labels:
|
|
level:
|
|
hostname:
|
|
|
|
- labeldrop:
|
|
- appname
|
|
|
|
- output:
|
|
source: message
|