筛选出日志行的Promtail配置

Question

我读过关于管道和管道的文档，我不能用它来做正面或反面。我想做的就是删除来自Uptimerobot软件的日志行，我们使用这些软件来确定我们的站点是否已经启动。

Promtail文档：https://grafana.com/docs/loki/latest/clients/promtail/pipelines/

日志采用json格式：

{ "time":"[17/Feb/2022:02:20:00 +0000]", "remoteIP":"172.18.0.4", "host":"api.mysite.tld", "request":"/v1/byUserId", "query":"", "method":"POST", "status":"200", "userAgent":"Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)", "referer":"https://api.mysite.tld/v1/byUserId" }

前尾配置

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
- job_name: apache_access
  static_configs:
  - targets:
      - localhost
    labels:
      job: apache_access
      __path__: /var/log/apache/site.access.log
  pipeline_stages:
    - json:
       expressions:
         userAgent: userAgent
    - drop:
       source: "userAgent"
       regex: ".*uptimerobot.*"

- job_name: apache_error
  static_configs:
  - targets:
      - localhost
    labels:
      job: apache_error
      __path__: /var/log/apache/site.error.log

上述配置将删除access作业中的所有行。

我如何修改它，使之只删除UptimeRobot在userAgent中的行呢？

编辑

下面是promtail日志：

level=info ts=2022-02-23T14:26:43.416816223Z caller=server.go:260 http=[::]:9080 grpc=[::]:46085 msg="server listening on addresses"
level=info ts=2022-02-23T14:26:43.417247269Z caller=main.go:119 msg="Starting Promtail" version="(version=2.4.1, branch=HEAD, revision=f61a4d261)"
level=info ts=2022-02-23T14:26:48.417542454Z caller=filetargetmanager.go:255 msg="Adding target" key="/var/log/apache/site.access.log:{job=\"apache_access\"}"
level=info ts=2022-02-23T14:26:48.417721078Z caller=filetargetmanager.go:255 msg="Adding target" key="/var/log/apache/site.error.log:{job=\"apache_error\"}"
ts=2022-02-23T14:26:48.417916312Z caller=log.go:168 level=info msg="Seeked /var/log/apache/site.access.log - &{Offset:0 Whence:0}"
level=info ts=2022-02-23T14:26:48.417970347Z caller=tailer.go:126 component=tailer msg="tail routine: started" path=/var/log/apache/site.access.log
ts=2022-02-23T14:26:48.419048351Z caller=log.go:168 level=info msg="Seeked /var/log/apache/site.error.log - &{Offset:0 Whence:0}"
level=info ts=2022-02-23T14:26:48.419071953Z caller=tailer.go:126 component=tailer msg="tail routine: started" path=/var/log/apache/site.error.log

编辑以包括建议的配置更改。

Answer 1

尝试将pipeline_stages更改为：

  pipeline_stages:
    - json:
       expressions:
         userAgent: userAgent
    - drop:
       source: "userAgent"
       regex: ".*uptimerobot.*"