Skip to content

Commit f9e7fab

Browse files
csilva-clcsilva-cl
authored
Merge pull request #1099 from lsst-it/IT-6430_more_alloy_labels
(fleet/alloy) add vpn and rsyslog connectors
2 parents ee0fa9c + c7f8858 commit f9e7fab

File tree

2 files changed

+176
-18
lines changed

2 files changed

+176
-18
lines changed

‎fleet/lib/alloy/overlays/antu/values.yaml‎

Lines changed: 89 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,22 @@ alloy:
1616
port: 1514
1717
targetPort: 1514
1818
protocol: TCP
19-
- name: syslog-udp
19+
- name: pfsense-udp
2020
port: 5141
2121
targetPort: 5141
2222
protocol: UDP
2323
- name: network-udp
2424
port: 5142
2525
targetPort: 5142
2626
protocol: UDP
27+
- name: openvpn-udp
28+
port: 5143
29+
targetPort: 5143
30+
protocol: UDP
31+
- name: rsyslog-udp
32+
port: 5514
33+
targetPort: 5514
34+
protocol: UDP
2735
- name: otelhttp
2836
port: 4318
2937
targetPort: 4318
@@ -121,10 +129,12 @@ alloy:
121129
stage.json {
122130
expressions = { level = "level" }
123131
}
132+
124133
stage.template {
125134
source = "level"
126135
template = "{{`{{ lower .Value }}`}}"
127136
}
137+
128138
stage.labels {
129139
values = {
130140
severity = "level",
@@ -165,17 +175,16 @@ alloy:
165175
discovery.relabel "syslog" {
166176
targets = []
167177
rule {
168-
source_labels = ["__syslog_message_hostname"]
169-
target_label = "host"
178+
source_labels = ["__syslog_message_hostname"]
179+
target_label = "host"
170180
}
171181
rule {
172-
source_labels = ["__syslog_message_app_name"]
173-
target_label = "app_name"
182+
source_labels = ["__syslog_message_app_name"]
183+
target_label = "app_name"
174184
}
175185
rule {
176-
source_labels = ["__syslog_connection_ip"]
177-
action = "replace"
178-
target_label = "host_ip"
186+
source_labels = ["__syslog_message_severity"]
187+
target_label = "severity"
179188
}
180189
}
181190
@@ -261,9 +270,80 @@ alloy:
261270
forward_to = [loki.write.send.receiver]
262271
}
263272
273+
loki.process "openvpn" {
274+
275+
stage.regex {
276+
expression = "AUTH (?P<auth_status>SUCCESS|FAILURE)"
277+
}
278+
279+
stage.regex {
280+
expression = "\\[stdout#(?P<stdout_level>\\w+)\\]"
281+
}
282+
283+
stage.regex {
284+
expression = "'status':\\s*(?P<status>\\d+)"
285+
}
286+
287+
stage.regex {
288+
expression = "'user':\\s*'(?P<user>[^']+)'"
289+
}
290+
291+
stage.regex {
292+
expression = "'reason':\\s*'(?P<reason>[^']+)'"
293+
}
294+
295+
stage.regex {
296+
expression = "'session_id':\\s*'(?P<session_id>[^']+)'"
297+
}
298+
299+
stage.regex {
300+
expression = "'common_name':\\s*'(?P<common_name>[^']+)'"
301+
}
302+
303+
stage.regex {
304+
expression = "'auth method':\\s*'(?P<auth_method>[^']+)'"
305+
}
306+
307+
stage.labels {
308+
values = {
309+
auth_status = "",
310+
stdout_level = "",
311+
status = "",
312+
user = "",
313+
common_name = "",
314+
auth_method = "",
315+
}
316+
}
317+
318+
forward_to = [loki.write.send.receiver]
319+
}
320+
321+
loki.source.syslog "openvpn" {
322+
listener {
323+
address = ":5143"
324+
protocol = "udp"
325+
syslog_format = "rfc3164"
326+
use_incoming_timestamp = false
327+
labels = { job = "openvpn" }
328+
}
329+
relabel_rules = discovery.relabel.syslog.rules
330+
forward_to = [loki.process.openvpn.receiver]
331+
}
332+
333+
loki.source.syslog "rsyslog" {
334+
listener {
335+
address = ":5514"
336+
syslog_format = "rfc3164"
337+
use_incoming_timestamp = false
338+
protocol = "udp"
339+
labels = { job = "node/rsyslog" }
340+
}
341+
relabel_rules = discovery.relabel.syslog.rules
342+
forward_to = [loki.write.send.receiver]
343+
}
344+
264345
loki.write "send" {
265346
endpoint {
266347
url = "http://loki-gateway.loki.svc.cluster.local/loki/api/v1/push"
267348
}
268-
external_labels = { job = "alloy" }
269349
}

‎fleet/lib/alloy/overlays/kona/values.yaml‎

Lines changed: 87 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,22 @@ alloy:
1616
port: 1514
1717
targetPort: 1514
1818
protocol: TCP
19-
- name: syslog-udp
19+
- name: pfsense-udp
2020
port: 5141
2121
targetPort: 5141
2222
protocol: UDP
2323
- name: network-udp
2424
port: 5142
2525
targetPort: 5142
2626
protocol: UDP
27+
- name: openvpn-udp
28+
port: 5143
29+
targetPort: 5143
30+
protocol: UDP
31+
- name: rsyslog-udp
32+
port: 5514
33+
targetPort: 5514
34+
protocol: UDP
2735
- name: otelhttp
2836
port: 4318
2937
targetPort: 4318
@@ -167,17 +175,16 @@ alloy:
167175
discovery.relabel "syslog" {
168176
targets = []
169177
rule {
170-
source_labels = ["__syslog_message_hostname"]
171-
target_label = "host"
178+
source_labels = ["__syslog_message_hostname"]
179+
target_label = "host"
172180
}
173181
rule {
174-
source_labels = ["__syslog_message_app_name"]
175-
target_label = "app_name"
182+
source_labels = ["__syslog_message_app_name"]
183+
target_label = "app_name"
176184
}
177185
rule {
178-
source_labels = ["__syslog_connection_ip"]
179-
action = "replace"
180-
target_label = "host_ip"
186+
source_labels = ["__syslog_message_severity"]
187+
target_label = "severity"
181188
}
182189
}
183190
@@ -263,9 +270,80 @@ alloy:
263270
forward_to = [loki.write.send.receiver]
264271
}
265272
273+
loki.process "openvpn" {
274+
275+
stage.regex {
276+
expression = "AUTH (?P<auth_status>SUCCESS|FAILURE)"
277+
}
278+
279+
stage.regex {
280+
expression = "\\[stdout#(?P<stdout_level>\\w+)\\]"
281+
}
282+
283+
stage.regex {
284+
expression = "'status':\\s*(?P<status>\\d+)"
285+
}
286+
287+
stage.regex {
288+
expression = "'user':\\s*'(?P<user>[^']+)'"
289+
}
290+
291+
stage.regex {
292+
expression = "'reason':\\s*'(?P<reason>[^']+)'"
293+
}
294+
295+
stage.regex {
296+
expression = "'session_id':\\s*'(?P<session_id>[^']+)'"
297+
}
298+
299+
stage.regex {
300+
expression = "'common_name':\\s*'(?P<common_name>[^']+)'"
301+
}
302+
303+
stage.regex {
304+
expression = "'auth method':\\s*'(?P<auth_method>[^']+)'"
305+
}
306+
307+
stage.labels {
308+
values = {
309+
auth_status = "",
310+
stdout_level = "",
311+
status = "",
312+
user = "",
313+
common_name = "",
314+
auth_method = "",
315+
}
316+
}
317+
318+
forward_to = [loki.write.send.receiver]
319+
}
320+
321+
loki.source.syslog "openvpn" {
322+
listener {
323+
address = ":5143"
324+
protocol = "udp"
325+
syslog_format = "rfc3164"
326+
use_incoming_timestamp = false
327+
labels = { job = "openvpn" }
328+
}
329+
relabel_rules = discovery.relabel.syslog.rules
330+
forward_to = [loki.process.openvpn.receiver]
331+
}
332+
333+
loki.source.syslog "rsyslog" {
334+
listener {
335+
address = ":5514"
336+
syslog_format = "rfc3164"
337+
use_incoming_timestamp = false
338+
protocol = "udp"
339+
labels = { job = "node/rsyslog" }
340+
}
341+
relabel_rules = discovery.relabel.syslog.rules
342+
forward_to = [loki.write.send.receiver]
343+
}
344+
266345
loki.write "send" {
267346
endpoint {
268347
url = "http://loki-gateway.loki.svc.cluster.local/loki/api/v1/push"
269348
}
270-
external_labels = { job = "alloy" }
271349
}

0 commit comments

Comments
 (0)