Change log level in eventlogmessage (#2336)

* change log level in eventlogmessage * changelog * update doc * Update docs/sources/reference/components/loki/loki.process.md Co-authored-by: Clayton Cornell <[email protected]> --------- Co-authored-by: Clayton Cornell <[email protected]>
grafana · Jan 3, 2025 · 44f2b26 · 44f2b26
1 parent dbfa7b7
commit 44f2b26
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -71,6 +71,8 @@ Main (unreleased)
 
 - Fixed an issue where the `otelcol.processor.interval` could not be used because the debug metrics were not set to default. (@wildum)
 
+- Change the log level in the `eventlogmessage` stage of the `loki.process` component from `warn` to `debug`. (@wildum)
+
 ### Other changes
 
 - Change the stability of the `livedebugging` feature from "experimental" to "generally available". (@wildum)

diff --git a/docs/sources/reference/components/loki/loki.process.md b/docs/sources/reference/components/loki/loki.process.md
@@ -258,6 +258,10 @@ If set to `false`, the `_extracted` suffix will be appended to an already existi
 When `drop_invalid_labels` is set to `true`, the stage drops fields that are not valid label names.
 If set to `false`, the stage will automatically convert them into valid labels replacing invalid characters with underscores.
 
+The `eventlogmessage` stage only extracts lines with the key:value format.
+All non-alpha characters in the key are replaced with underscores.
+For example, `\tSecurity ID` is extracted as `_Security_ID`.
+
 #### Example combined with `stage.json`
 
 ```alloy

diff --git a/internal/component/loki/process/stages/eventlogmessage.go b/internal/component/loki/process/stages/eventlogmessage.go
@@ -78,7 +78,7 @@ func (m *eventLogMessageStage) processEntry(extracted map[string]interface{}, ke
 	for _, line := range lines {
 		parts := strings.SplitN(line, ":", 2)
 		if len(parts) < 2 {
-			level.Warn(m.logger).Log("msg", "invalid line parsed from message", "line", line)
+			level.Debug(m.logger).Log("msg", "invalid line parsed from message", "line", line)
 			continue
 		}
 		mkey := parts[0]