Understanding Promtail Relabeling for Log Levels

This document demonstrates how to use Promtail's relabeling configurations to convert log levels from uppercase to lowercase. This is a common requirement for standardizing log data, making it easier to filter, search, and analyze logs within Loki.

Promtail Configuration Example

Below is a Promtail configuration snippet that utilizes pipeline stages to achieve the conversion of log levels.

server:
  http_listen_port: 9080
  grpc_listen_port: 0
positions:
  filename: /var/lib/promtail/positions.yaml
clients:
  - url: https://<LOKI_USERNAME>:<LOKI_PASSWORD>@<LOKI_FQDN>/loki/api/v1/push

scrape_configs:
  - job_name: nginx-info
    static_configs:
    - targets:
        - localhost
      labels:
        job: prod/nginx
        environment: production
        host: demo-app-prod
        level: info
        service_name: demo-app-prod
        __path__: /var/log/nginx/access.log

    pipeline_stages:
    # convert capital log levels to lower case
    - regex:
        expression: "(?P<level>(INFO|WARNING|ERROR))(.*)"
    # set captured values to lowercase
    - template:
        source: level
        template: '{{ ToLower .Value }}'
    # set the renamed values to level label
    - labels:
        level:

Explanation of Pipeline Stages

Regex Stage for Capturing Log Levels

The first pipeline stage uses a regular expression to capture log levels that are in uppercase (INFO, WARNING, ERROR). The captured value is named 'level'.

Template Stage for Lowercasing

The second stage employs a template to convert the captured 'level' value to lowercase using the ToLower function.

Labels Stage for Applying Converted Levels

Finally, the labels stage takes the lowercased value from the 'level' source and applies it to the 'level' label, effectively standardizing the log level.

Benefits of Standardized Log Levels

Standardizing log levels to a consistent format (e.g., all lowercase) significantly improves the usability of your log aggregation system. It allows for more straightforward querying and filtering in tools like Loki, enabling faster troubleshooting and more efficient log analysis. This Promtail configuration is a practical example of how to implement such standardization.