From 9106f3bd8b472811b2aa6b3333e36e474ef3a125 Mon Sep 17 00:00:00 2001
From: Ryan Cavicchioni <ryan@cavi.cc>
Date: Mon, 14 Jul 2025 12:23:26 -0500
Subject: [PATCH] forward Kubernetes system logs to Loki with Alloy

---
 alloy/values-development.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/alloy/values-development.yaml b/alloy/values-development.yaml
index 2d72144..c8a9841 100644
--- a/alloy/values-development.yaml
+++ b/alloy/values-development.yaml
@@ -9,6 +9,24 @@ alloy:
           }
         }
 
+        // local.file_match discovers files on the local filesystem using glob patterns and the doublestar library. It returns an array of file paths.
+        local.file_match "node_logs" {
+          path_targets = [{
+              // Monitor syslog to scrape node-logs
+              __path__  = "/var/log/messages",
+              job       = "node/syslog",
+              node_name = sys.env("HOSTNAME"),
+              cluster   = "development",
+          }]
+        }
+
+        // loki.source.file reads log entries from files and forwards them to other loki.* components.
+        // You can specify multiple loki.source.file components by giving them different labels.
+        loki.source.file "node_logs" {
+          targets    = local.file_match.node_logs.targets
+          forward_to = [loki.write.default.receiver]
+        }
+
         // discovery.kubernetes allows you to find scrape targets from Kubernetes resources.
         // It watches cluster state and ensures targets are continually synced with what is currently running in your cluster.
         discovery.kubernetes "pod" {