Provide option to set log format for faro.receiver component

[titaneric]

Request

Present log format for faro.receiver component is logfmt, which is fixed and not consistent to format setting in logging configuration block.

I want to request a new option to set the log format for faro.receiver, either define in faro.receiver component or faro.receiver component could send the consistent log format in the logging block.

Use case

Faro v1.4.0 introduces the performance metrics to send event type to faro.receiver..

The request payload is similar to the following one.

faro.receiver would digest the events and serialize them with logfmt, similar to the following one.

timestamp="2024-08-30 09:25:32.372 +0000 UTC" kind=event event_name=faro.performance.resource event_domain=browser event_data_cacheHitStatus=fullLoad event_data_decodedBodySize=21691 event_data_dnsLookupTime=0 event_data_duration=897 event_data_encodedBodySize=6543 event_data_faroNavigationId=FaHZGcZUVj event_data_faroResourceId=RkouBvZU5Y event_data_fetchTime=897 event_data_initiatorType=fetch event_data_name="https://test-domain.com/?_rsc=1nmqd" event_data_protocol=h2 event_data_redirectTime=0 event_data_renderBlockingStatus=non-blocking event_data_requestTime=514 event_data_responseStatus=200 event_data_responseTime=380 event_data_serviceWorkerTime=670 event_data_tcpHandshakeTime=0 event_data_tlsNegotiationTime=3 sdk_version=1.9.0 app_name=app_name app_version=1.0.0 app_environment=production session_id=qXMAWiEub1 page_url=https://test-domain.com/ browser_name=Edge browser_version=128.0.0.0 browser_os="Mac OS 10.15.7" browser_mobile=false view_name=default

Here comes the issue, since event_data_name="https://test-domain.com/?_rsc=1nmqd" would have the paramaters, and it has the equal sign (=) inside the url. If I adopt log.process to pre-process the log with the following component, I would have the error.

loki.process "parse" {
  stage.logfmt {
    mapping = { "event_data_name" = "event_data_name" }
  }
  forward_to = [loki.echo.example.receiver]
}

The error is

ts=2024-08-30T11:27:23.30414735Z level=error msg="failed to decode logfmt" component_path=/ component_id=loki.process.parse component=stage type=logfmt err="logfmt syntax error at pos 442 on line 1: unexpected '='"

The position 442 is EXACTLY the position of equal sign in the event_data_name label.

I want to pre-process the event_data_name label and remove the domain name and parametes, replace the GET single resource path (e.g., /post/xxxx) with /post/*, and adopt logql to demonstrate the query Loki datasource on Grafana.

Hope the use case is clear enough.

[titaneric]

Update here:

I have tried the replace stage in log.process component, and replace the event_data_name with parsed URL path. As as result, I could adopt the logfmt stage successfully since the paramater is removed from the event_data_name.

loki.process "parse" {
stage.replace {
    expression = "event_data_name=\"(?P<extracted_event_url>[^\"]+)\""
    replace = "{{ index (urlParse .Value) \"path\" }}"
}
stage.logfmt {
    mapping = {
      "app_name" = "",
      "app_version" = "",
      "app_environment" = "",
    }
}
stage.labels {
    values = {
      app_name  = "",        
      app_version  = "",        
      app_environment  = "",        
    }
}
forward_to = [loki.echo.example.receiver]
}

loki.echo "example" {
}

I think this is a workaround solution, and I really want I could configure the json log format for faro.receiver.

[titaneric]

Update again:

I have updated Grafana Alloy to v1.3.0, and I could adopt logfmt stage directly for performance resource log.

[github-actions]

This issue has not had any activity in the past 30 days, so the needs-attention label has been added to it.
If the opened issue is a bug, check to see if a newer release fixed your issue. If it is no longer relevant, please feel free to close this issue.
The needs-attention label signals to maintainers that something has fallen through the cracks. No action is needed by you; your issue will be kept open and you do not have to respond to this comment. The label will be removed the next time this job runs if there is new activity.
Thank you for your contributions!

[ptodev]

Hi @titaneric! #2276 will add support for the json format.