json - 在 promtail 中解析 docker JSON 日志的正确方法

Question

我已经使用 grafana、loki 和 promtail 创建了一些监控。我从中获取日志的容器以 JSON 格式输出它们，即

{"level":"info","ts":"2022-02-17T01:12:50.304Z","logger":"balance_log","caller":"services/balance_monitor.go:122","msg":"New ETH balance for 0x00: 50.492508167015966629","evmChainID":"137","address":"0x00","ethBalance":"50.492508167015966629","weiBalance":"50492508167015966629"}

{"level":"info","ts":"2022-02-17T01:19:35.350Z","logger":"DirectRequest.DirectRequest","caller":"directrequest/delegate.go:280","msg":"Oracle request received","contract":"0x00","jobName":"","jobID":0,"externalJobID":"b93c6769-1bd4-474b-9a01-e8ada08825f7","specId":"0000","requester":"0x00","requestId":"000","payment":"1500000000000000","callbackAddr":"0x00","callbackFunctionId":"4357855e","cancelExpiration":"1645061075","dataVersion":"1","data":"000"}

目前 grafana 将显示名为 log 的表，其内容为字符串即:

"log": "{\"level\": \"info\"....

设置 promtail 配置的正确方法是什么，以便我可以获得所有格式化的数据以在 TableView 中使用？

这是我目前拥有的:

server:
  http_listen_address: 0.0.0.0
  http_listen_port: 9080

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/loki/api/v1/push

scrape_configs:

- job_name: system
  static_configs:
  - targets:
      - localhost
    labels:
      job: varlogs
      __path__: /var/log/*log

- job_name: containers
  entry_parser: raw

  static_configs:
  - targets:
      - localhost
    labels:
      job: containerlogs
      __path__: /var/lib/docker/containers/*/*log

  # --log-opt tag="{{.ImageName}}|{{.Name}}|{{.ImageFullID}}|{{.FullID}}"
  pipeline_stages:

  - json:
      expressions:
        stream: stream
        attrs: attrs
        tag: attrs.tag
  - regex:
      expression: (?P<image_name>(?:[^|]*[^|])).(?P<container_name>(?:[^|]*[^|])).(?P<image_id>(?:[^|]*[^|])).(?P<container_id>(?:[^|]*[^|]))
      source: "tag"

  - labels:
      tag:
      stream:
      image_name:
      container_name:
      image_id:
      container_id:

Answer 1

您需要使用 pipeline stage for Docker一开始。

像这样:

      pipeline_stages:
        - docker: {}