通過配置promtail的配置文件,可以實現:1.推送系統日志(journal)到loki;2.遞歸文件目錄推送消息到loki
1.推送系統日志配置如下:
scrape_configs:
- job_name: journal
journal:
json: false
max_age: 12h
path: /var/log/journal
labels:
job: systemd-journal
relabel_configs:
- source_labels: ['__journal__systemd_unit']
target_label: 'unit'
- source_labels:
- __journal__hostname
target_label: 'nodename'
- source_labels:
- __journal_syslog_identifier
target_label: syslog_identifier
注意事項:
(1)需要把journal的內置指標relabel成target指標,不然相關指標不顯示;
(2)保證目錄/var/log/journal存在。如果沒有,新建文件夾;
(3)/var/log/journal內容會增長很快,容易撐爆磁盤。建議限制日志大小:
journalctl --vacuum-size=500M
(4)如果通過容器安裝promtail,官網強調,需要掛載 "/etc/machine-id"
volumes:
- /var/log/journal:/var/log/journal
- /run/log/journal:/run/log/journal
- /etc/machine-id:/etc/machine-id
2.遞歸文件目錄推送消息到loki
- job_name: buss
static_configs:
- targets:
- localhost
labels:
job: test
app: test_log
__path__: /var/log/danny/**/*log
其中的 “/var/log/danny/**/*log” 表示遞歸推送/var/log/danny下,所有log結尾的文件內容。promtail啟動日志如下: