Traefik logs with Grafana Alloy

Extra! Extra! Promtail is now deprecated!

You can read all about it in the Grafana Documentation, but let’s get straight to the point.

You have Traefik and you want to send the logs to a Grafana dashboard. Since we usually used Promtail to gather logs and send them to Loki, and that’s now deprecated, let’s see how to quickly configure Grafana Alloy for this.

The Promtail GeoIP Config

First, let’s look at an example of a Promtail config that used GeoIP with the GeoLite2-City database.

#YAML
- job_name: traefik
    static_configs:
      - targets:
          - localhost
        labels:
          job: traefiklogs
          __path__: /var/log/traefik/*.log
    pipeline_stages:
      - json:
          expressions:
            ClientHost: ClientHost
      - geoip:
          source: "ClientHost"
          db: "/etc/promtail/GeoLite2-City.mmdb"
          db_type: city

Simple and to the point. Now let’s see how to do the same with Alloy.

The Grafana Alloy Config

#Alloy
local.file_match "traefiklogs" {
  path_targets = [
    {
      __path__ = "/var/log/traefik/**.log",
      job      = "traefiklogs",
    },
  ]
}
loki.source.file "traefiklogs" {
  targets    = local.file_match.traefiklogs.targets
  forward_to = [loki.process.traefik_geo.receiver]
}

loki.process "traefik_geo" {
  stage.json {
    expressions = {
      ClientHost = "ClientHost",
    }
  }

  stage.geoip {
    db = "/etc/alloy/GeoLite2-City.mmdb"
    db_type = "city"
    source  = "ClientHost"
  }
  stage.labels {
        values = {
            geoip_city_name          = "",
            geoip_country_name       = "",
            geoip_country_code       = "",
            geoip_continent_name     = "",
            geoip_continent_code     = "",
            geoip_location_latitude  = "",
            geoip_location_longitude = "",
            geoip_postal_code        = "",
            geoip_timezone           = "",
            geoip_subdivision_name   = "",
            geoip_subdivision_code   = "",
        }
    }

  forward_to = [loki.write.default.receiver]
}

As you can see, transitioning from Promtail to Grafana Alloy doesn’t require a complete overhaul, and sometimes can be automated via Alloy convert command, but sometimes it can leave you confused and not sure what to do.

The core logic of processing and forwarding logs remains the same, just with a different syntax. This change ensures your logging pipeline stays up-to-date and fully supported by the Grafana ecosystem. Happy logging!