How to send the .message field to Loki in json form && How use the rest of the field as a loki label

[devops-taehoon-kim]

Question

Hi.

I want to use kubernetes pod labels and pod name, namespace to loki label.

But i have one problem.

I want to send our logs to loki with 'json format'

our log format is mostly json format.

But When i use " . = parse_json!(.message) " , fields using kubernetes_logs is gone..

so i tried this, too

..
.message = parse_json!(.message)
..

and then, loki sinks, encoding.coded: raw_message

but this not shows like json at grafana.

Any advice to me ?

Thanks

---

What i want to

• use kubernetes_logs`s field (container_name, pod_name, pod_namespace, node_name, ..)
• send message logs using json format to grafana loki

Vector Config

Tested

sources:
kubernetes_logs:
type: kubernetes_logs
include_paths_glob_patterns:
- "/istio-proxy/"

transforms:

  remap: 
    inputs:
      - kubernetes_logs
    type: remap
    source: |-
      . = parse_json!(.message)

sinks:
  loki:
    inputs:
      - remap
    type: "loki"
    encoding:
      codec: "json"
    compression: snappy
    labels:
      log_source: vector
      vector_test_namespace: '{{ labels.namespace }}'
    endpoint: https://grafana-loki-gateway.xxxxxxxx.xxxxxxx.xxx
    path: /loki/api/v1/push
    remove_timestamp: true
    healthcheck:
      enabled: false
    tenant_id: xxxxxxx

Vector Logs

No response