163 lines
3.9 KiB
Django/Jinja
163 lines
3.9 KiB
Django/Jinja
// Prometheus metrics collection
|
|
prometheus.exporter.unix "node" {
|
|
rootfs_path = "/host/root"
|
|
sysfs_path = "/host/sys"
|
|
procfs_path = "/host/proc"
|
|
textfile {
|
|
directory = "/host/root/var/lib/node_exporter/textfile_collector"
|
|
}
|
|
|
|
set_collectors = ["cpu", "loadavg", "meminfo", "diskstats", "filesystem", "netdev", "textfile"]
|
|
}
|
|
|
|
prometheus.scrape "node_exporter" {
|
|
targets = prometheus.exporter.unix.node.targets
|
|
forward_to = [prometheus.remote_write.metrics.receiver]
|
|
}
|
|
|
|
prometheus.scrape "alloy" {
|
|
targets = [{
|
|
__address__ = "localhost:{{ alloy_port }}",
|
|
}]
|
|
forward_to = [prometheus.remote_write.metrics.receiver]
|
|
}
|
|
|
|
prometheus.exporter.cadvisor "docker" {
|
|
docker_host = "unix:///var/run/docker.sock"
|
|
docker_only = true
|
|
}
|
|
|
|
prometheus.scrape "cadvisor" {
|
|
targets = prometheus.exporter.cadvisor.docker.targets
|
|
forward_to = [prometheus.remote_write.metrics.receiver]
|
|
}
|
|
|
|
prometheus.remote_write "metrics" {
|
|
endpoint {
|
|
url = "http://prometheus:{{ prometheus_port }}/api/v1/write"
|
|
}
|
|
}
|
|
|
|
// Journal log collection (includes both system logs and Docker containers)
|
|
loki.source.journal "journal" {
|
|
forward_to = [loki.process.journal.receiver]
|
|
relabel_rules = loki.relabel.journal.rules
|
|
labels = {
|
|
job = "journal",
|
|
}
|
|
}
|
|
|
|
loki.relabel "journal" {
|
|
forward_to = []
|
|
|
|
// Systemd unit (e.g., ssh.service, docker.service)
|
|
rule {
|
|
source_labels = ["__journal__systemd_unit"]
|
|
target_label = "unit"
|
|
}
|
|
|
|
// Container name for Docker containers
|
|
rule {
|
|
source_labels = ["__journal_container_name"]
|
|
target_label = "container"
|
|
}
|
|
|
|
// Syslog priority (0=emerg, 1=alert, 2=crit, 3=err, 4=warn, 5=notice, 6=info, 7=debug)
|
|
rule {
|
|
source_labels = ["__journal_priority"]
|
|
target_label = "priority"
|
|
}
|
|
|
|
// Syslog identifier (program name)
|
|
rule {
|
|
source_labels = ["__journal_syslog_identifier"]
|
|
target_label = "syslog_identifier"
|
|
}
|
|
|
|
// Tag tuwunel container with its own job label
|
|
rule {
|
|
source_labels = ["__journal_container_name"]
|
|
regex = "tuwunel"
|
|
target_label = "job"
|
|
replacement = "tuwunel"
|
|
}
|
|
}
|
|
|
|
loki.process "journal" {
|
|
forward_to = [loki.write.logs.receiver]
|
|
|
|
// Extract log level from common formats: level=info, "level":"info", [INFO], etc.
|
|
stage.regex {
|
|
expression = "(?i)(level=|\"level\":\\s*\"|\\[)(?P<extracted_level>debug|info|warn|warning|error|err|fatal|panic|critical|crit|notice)(\\]|\"|\\s|$)"
|
|
}
|
|
|
|
// Map extracted level to numeric priority for consistent filtering
|
|
stage.template {
|
|
source = "level"
|
|
template = "{% raw %}{{ if .extracted_level }}{{ .extracted_level }}{{ else }}{{ .priority }}{{ end }}{% endraw %}"
|
|
}
|
|
|
|
stage.labels {
|
|
values = {
|
|
level = "",
|
|
}
|
|
}
|
|
}
|
|
|
|
loki.write "logs" {
|
|
endpoint {
|
|
url = "http://loki:{{ loki_port }}/loki/api/v1/push"
|
|
}
|
|
}
|
|
|
|
// Fail2ban log file collection (ban/unban details go to file, not journald)
|
|
local.file_match "fail2ban" {
|
|
path_targets = [{"__path__" = "/host/root/var/log/fail2ban.log"}]
|
|
}
|
|
|
|
loki.source.file "fail2ban" {
|
|
targets = local.file_match.fail2ban.targets
|
|
forward_to = [loki.process.fail2ban.receiver]
|
|
}
|
|
|
|
loki.process "fail2ban" {
|
|
forward_to = [loki.write.logs.receiver]
|
|
|
|
stage.static_labels {
|
|
values = {
|
|
job = "fail2ban",
|
|
unit = "fail2ban.service",
|
|
}
|
|
}
|
|
|
|
stage.regex {
|
|
expression = "(?i)\\s(?P<extracted_level>notice|warning|error|info)\\s"
|
|
}
|
|
|
|
stage.labels {
|
|
values = {
|
|
level = "extracted_level",
|
|
}
|
|
}
|
|
}
|
|
|
|
// Rspamd log file collection (logs to file inside mailserver, not stdout)
|
|
local.file_match "rspamd" {
|
|
path_targets = [{"__path__" = "/host/root/srv/mail/maillogs/rspamd.log"}]
|
|
}
|
|
|
|
loki.source.file "rspamd" {
|
|
targets = local.file_match.rspamd.targets
|
|
forward_to = [loki.process.rspamd.receiver]
|
|
}
|
|
|
|
loki.process "rspamd" {
|
|
forward_to = [loki.write.logs.receiver]
|
|
|
|
stage.static_labels {
|
|
values = {
|
|
container = "mailserver",
|
|
job = "rspamd",
|
|
}
|
|
}
|
|
}
|