Add loki.enrich component by v-zhuravlev · Pull Request #2882 · grafana/alloy

v-zhuravlev · 2025-03-02T16:26:19Z

PR Description

This PR adds a new loki.enrich component that enriches Loki logs with labels from discovery.* components.
The component matches a label from incoming logs against a label from discovered targets, and copies specified labels from the matched target to the log entry.

Should solve #810 and likely https://community.grafana.com/t/enrich-logs-with-alloy/128738.

Features:

Copy selected labels from matched targets to logs
Support for any discovery component (file, DNS, HTTP, etc.)

Example use cases to ensure best logs-metrics correlation:

Enrich Network devices syslog messages with device metadata(as labels) from IP address management (IPAM)/Data center infrastructure management(DCIM) like Netbox (https://github.com/FlxPeters/netbox-plugin-prometheus-sd). It could be same labels as used by prometheus.exporter.snmp or other metric scrapers.
Ensure metrics and logs use same labelset (gathered from same discovery.* component) even if metrics are scraped from prometheus endpoints and logs are received via loki.source.api.

Notes to the Reviewer

loki.enrich forwards logs unchanged if no match is found
loki.enrich should work with any discovery.* component. Best combined with discovery.relabel to rename hidden labels if present.
The integration test demonstrates:
- Sample log pushed via HTTP API and then additional labels added using file-based discovery sample

PR Checklist

CHANGELOG.md updated
Documentation added
Tests updated
Config converters updated

github-actions · 2025-03-02T16:27:54Z

💻 Deploy preview deleted.

… optional.

v-zhuravlev · 2025-03-05T10:09:33Z

Similar functionality, but not applicable to syslog as of now: https://grafana.com/docs/alloy/latest/reference/stdlib/array/#arraycombine_maps

ptodev

@v-zhuravlev thank you, this looks interesting! Could you please edit the description that this solves #810?

Btw we also have a similar component for traces - otelcol.processor.discovery.

docs/sources/reference/components/loki/loki.enrich.md

ptodev · 2025-03-10T18:07:45Z

internal/component/loki/enrich/enrich.go

+	// Initialize the cache with provided targets
+	c.refreshCacheFromTargets(args.Targets)


I think if the discovery component will just return an empty map if it hasn't discovered anything yet? Then loki.enrich would still not work for the first few seconds until the discovery starts working?

hm, possibly. Is there any way to force discovery before component is initialized?

I don't think so.

is it acceptable?

otelcol.processor.k8sattributes has had a similar problem and they added an optional wait_for_metadata_timeout argument to work around it. You could add something similar, but it's not necessary. As long as this limitation is documented that's ok.

thanks for providing this example! I think I add a note for now.

ptodev · 2025-03-10T18:09:01Z

internal/component/loki/enrich/enrich.go

+
+func init() {
+	component.Register(component.Registration{
+		Name:      "loki.enrich",


loki.enrich sounds like a good name. Initially I thought there should be a reference to discovery or targets in the name, but I gave up on that thought because in theory the targets don't have to come from a discovery component.

github-actions · 2025-03-12T16:06:03Z

💻 Deploy preview deleted.

clayton-cornell

Some initial input to the docs

docs/sources/reference/components/loki/loki.enrich.md

Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>

clayton-cornell · 2025-03-14T14:30:53Z

Docs are OK for this iteration. I'll wait until code review is complete for the Approve from docs.

docs/sources/reference/components/loki/loki.enrich.md

Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>

ptodev

LGTM, just one minor docs coment.

docs/sources/reference/components/loki/loki.enrich.md

Co-authored-by: Paulin Todev <paulin.todev@gmail.com>

* Add loki.enricher * Add missing comma * Fix config.alloy * Fix integration test * Fix tests * Register in all.go * Update docs * rename to loki.enrich * Update docs * rename to network * Update docs * Remove redundant label * Update test * rename int test * Rename * Add hidden label * Fix tests * Update changelog * Make target_label optional * Rename to logs_match_label, target_match_label. Make logs_match_label optional. * Update test * rename to labels_to_copy * Update docs/sources/reference/components/loki/loki.enrich.md Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com> * Update docs * Add limitation notice * Update docs/sources/reference/components/loki/loki.enrich.md Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com> * Update docs/sources/reference/components/loki/loki.enrich.md Co-authored-by: Paulin Todev <paulin.todev@gmail.com> * Add caution in docs --------- Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com> Co-authored-by: Paulin Todev <paulin.todev@gmail.com>

Add loki.enricher

1e9197c

v-zhuravlev added 9 commits March 2, 2025 16:33

Add missing comma

3587566

Fix config.alloy

2405517

Fix integration test

7165296

Fix tests

d2521c3

Register in all.go

3308f9d

Update docs

601e0ad

rename to loki.enrich

dccff19

Update docs

8238809

rename to network

68aa3a0

v-zhuravlev changed the title ~~Add loki.enricher component (WIP)~~ Add loki.enrich component (WIP) Mar 3, 2025

v-zhuravlev added 11 commits March 4, 2025 15:49

Update docs

3b8cf7d

Remove redundant label

812da2d

Update test

04ad59b

rename int test

ecf9e1a

Rename

d721016

Add hidden label

2b8f416

Fix tests

69cb0cc

Update changelog

69ee31b

Make target_label optional

bb4e734

Rename to logs_match_label, target_match_label. Make logs_match_label…

e8d79cd

… optional.

Update test

634190c

v-zhuravlev changed the title ~~Add loki.enrich component (WIP)~~ Add loki.enrich component Mar 4, 2025

v-zhuravlev marked this pull request as ready for review March 4, 2025 22:54

v-zhuravlev requested review from a team and clayton-cornell as code owners March 4, 2025 22:54

v-zhuravlev requested a review from wildum March 4, 2025 23:05

v-zhuravlev closed this Mar 5, 2025

v-zhuravlev reopened this Mar 5, 2025

v-zhuravlev mentioned this pull request Mar 5, 2025

Add logs enrich #2910

Closed

ptodev reviewed Mar 10, 2025

View reviewed changes

v-zhuravlev requested a review from ptodev March 12, 2025 05:41

rename to labels_to_copy

200d27e

clayton-cornell reviewed Mar 13, 2025

View reviewed changes

v-zhuravlev and others added 3 commits March 14, 2025 17:11

Update docs/sources/reference/components/loki/loki.enrich.md

52a78ca

Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>

Apply suggestions from code review

364be62

Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>

Update docs

6696539

v-zhuravlev requested a review from clayton-cornell March 14, 2025 09:25

clayton-cornell added the type/docs Docs Squad label across all Grafana Labs repos label Mar 14, 2025

Add limitation notice

c4e200c

clayton-cornell reviewed Mar 14, 2025

View reviewed changes

docs/sources/reference/components/loki/loki.enrich.md Outdated Show resolved Hide resolved

Update docs/sources/reference/components/loki/loki.enrich.md

c37d243

Co-authored-by: Clayton Cornell <131809008+clayton-cornell@users.noreply.github.com>

ptodev reviewed Mar 17, 2025

View reviewed changes

docs/sources/reference/components/loki/loki.enrich.md Outdated Show resolved Hide resolved

Update docs/sources/reference/components/loki/loki.enrich.md

3e2e3e4

Co-authored-by: Paulin Todev <paulin.todev@gmail.com>

v-zhuravlev requested a review from clayton-cornell March 17, 2025 15:15

Add caution in docs

ba566fd

v-zhuravlev requested a review from ptodev March 17, 2025 17:55

Merge branch 'main' into vzhuravlev/loki_enricher

ec1fd2c

ptodev approved these changes Mar 19, 2025

View reviewed changes

clayton-cornell approved these changes Mar 19, 2025

View reviewed changes

ptodev merged commit 14b4a8c into main Mar 20, 2025
35 checks passed

ptodev deleted the vzhuravlev/loki_enricher branch March 20, 2025 12:36

github-actions bot added the frozen-due-to-age label Apr 20, 2025

github-actions bot locked as resolved and limited conversation to collaborators Apr 20, 2025

		// Initialize the cache with provided targets
		c.refreshCacheFromTargets(args.Targets)

Conversation

v-zhuravlev commented Mar 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Description

Notes to the Reviewer

PR Checklist

Uh oh!

github-actions bot commented Mar 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-zhuravlev commented Mar 5, 2025

Uh oh!

ptodev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ptodev Mar 10, 2025

Choose a reason for hiding this comment

Uh oh!

v-zhuravlev Mar 12, 2025

Choose a reason for hiding this comment

Uh oh!

ptodev Mar 12, 2025

Choose a reason for hiding this comment

Uh oh!

v-zhuravlev Mar 12, 2025

Choose a reason for hiding this comment

Uh oh!

ptodev Mar 14, 2025

Choose a reason for hiding this comment

Uh oh!

v-zhuravlev Mar 14, 2025

Choose a reason for hiding this comment

Uh oh!

ptodev Mar 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clayton-cornell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

clayton-cornell commented Mar 14, 2025

Uh oh!

Uh oh!

ptodev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

v-zhuravlev commented Mar 2, 2025 •

edited

Loading

github-actions bot commented Mar 2, 2025 •

edited

Loading

github-actions bot commented Mar 12, 2025 •

edited

Loading