config.alloy v1

discovery.relabel "syslog" {
    targets = []

    rule {
        source_labels = ["__syslog_message_hostname"]
        target_label  = "host"
    }

    rule {
        source_labels = ["__syslog_message_hostname"]
        target_label  = "hostname"
    }

    rule {
        source_labels = ["__syslog_message_severity"]
        target_label  = "level"
    }

    rule {
        source_labels = ["__syslog_message_app_name"]
        target_label  = "application"
    }

    rule {
        source_labels = ["__syslog_message_facility"]
        target_label  = "facility"
    }

    rule {
        source_labels = ["__syslog_connection_hostname"]
        target_label  = "connection_hostname"
    }
}

loki.source.syslog "syslog" {
    listener {
        address      = "0.0.0.0:601"
        protocol     = "tcp"
        idle_timeout = "0s"
        use_rfc5424_message = true
        labels       = { job = "syslog", component = "loki.source.syslog", protocol = "tcp" }
        max_message_length = 0
    }
    listener {
        address      = "0.0.0.0:51893"
        protocol     = "tcp"
        idle_timeout = "0s"
        use_rfc5424_message = true
        labels       = { job = "syslog", component = "loki.source.syslog", protocol = "tcp" }
        max_message_length = 0
    }
    forward_to    = [loki.write.syslog.receiver]
    relabel_rules = discovery.relabel.syslog.rules
}

loki.write "syslog" {
    endpoint {
        url = "http://x.x.x.x:3100/loki/api/v1/push"
    }
}