server:
  http_listen_address: 0.0.0.0
  http_listen_port: 9080

positions:
  filename: "/var/promtail/positions_${HOSTNAME}.yaml" # remove "_${HOST_HOSTNAME}" if you do not use docker swarm

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:

- job_name: containers
  static_configs:
  - targets:
      - localhost
    labels:
      job: containers_logs
      node_hostname: "${HOSTNAME}" # remove line if you do not use docker swarm
      __path__: /var/lib/docker/containers/*/*log

  pipeline_stages:
  - json:
      expressions:
        log: log
        stream: stream
        time: time
        tag: attrs.tag
        # docker compose
        compose_project: attrs."com.docker.compose.project"
        compose_service: attrs."com.docker.compose.service"
        # docker swarm
        stack_name: attrs."com.docker.stack.namespace"
        service_name: attrs."com.docker.swarm.service.name"
        service_id: attrs."com.docker.swarm.service.id"
        task_name: attrs."com.docker.swarm.task.name"
        task_id: attrs."com.docker.swarm.task.id"
        node_id: attrs."com.docker.swarm.node.id"
  - regex:
      expression: "^/var/lib/docker/containers/(?P<container_id>.{12}).+/.+-json.log$"
      source: filename
  - timestamp:
      format: RFC3339Nano
      source: time
  - labels:
      stream:
      container_id:
      tag:
      # docker compose
      compose_project:
      compose_service:
      # docker swarm
      stack_name:
      service_name:
      service_id:
      task_name:
      task_id:
      node_id:
  - output:
      source: log
- job_name: mount_values
  static_configs:
  - targets:
      - localhost
    labels:
      job: mount_values_logs
      __path__: /opt/r7-office-docker/support_logs/*/*.log  #/var/lib/docker/containers/*/*log
  pipeline_stages:
  - multiline:
      firstline: '^\d{2}:\d{2}:\d{2}\.\d{4}'  # Первая строка каждой записи начинается с временной метки
      max_wait_time_seconds: 10                     # Ждать максимум 10 сек для окончания текущей записи
  - regex:
      expression: '^(.*)\s+(INFO|WARN|DEBUG|ERROR|CRITICAL|FATAL)\s+(.+)\s*(.+)'  # Парсим лог
      groups:
        1: time                                    # Время
        2: level                                   # Уровень логирования
        3: source                                  # Источник события
        4: message                                 # Само сообщение
  - timestamp:
      format: "15:04:05.0000"                      # Формат времени для преобразования
      source: time
  - labels:
      level:
      source:
  - output:
      source: message
