From cffb3875808f8641611d3bf5e146adda9d0bd254 Mon Sep 17 00:00:00 2001
From: Simon <s.thiessen@local-it.org>
Date: Tue, 8 Sep 2026 16:30:54 +0200
Subject: [PATCH 1/3] split image tag

---
 config.alloy.tmpl | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/config.alloy.tmpl b/config.alloy.tmpl
index c8af4ad..dabd6c5 100644
--- a/config.alloy.tmpl
+++ b/config.alloy.tmpl
@@ -48,7 +48,32 @@ prometheus.scrape "default" {
     prometheus.exporter.cadvisor.docker.targets,
   )
 
+  forward_to = [prometheus.relabel.container_meta.receiver]
+}
+
+prometheus.relabel "container_meta" {
   forward_to = [prometheus.remote_write.prometheus.receiver]
+
+  // remove sha tail: nginx:1.31.1@sha256:608a... -> nginx:1.31.1
+  rule {
+    source_labels = ["image"]
+    regex         = "([^@]+)@sha256:.*"
+    target_label  = "image"
+    replacement   = "$1"
+  }
+  // split image in name and tag
+  rule {
+    source_labels = ["image"]
+    regex         = "(.+):[^:/]+"
+    target_label  = "image_name"
+    replacement   = "$1"
+  }
+  rule {
+    source_labels = ["image"]
+    regex         = ".+:([^:/]+)"
+    target_label  = "image_tag"
+    replacement   = "$1"
+  }
 }
 
 prometheus.remote_write "prometheus" {
-- 
2.54.0


From e22d6bae833b557c164721fec958066224bf4a84 Mon Sep 17 00:00:00 2001
From: Simon <s.thiessen@local-it.org>
Date: Tue, 15 Sep 2026 23:22:26 +0200
Subject: [PATCH 2/3] relabel journald logs and drop networkDB stats

---
 config.alloy.tmpl | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/config.alloy.tmpl b/config.alloy.tmpl
index dabd6c5..1351073 100644
--- a/config.alloy.tmpl
+++ b/config.alloy.tmpl
@@ -311,7 +311,35 @@ loki.source.docker "docker" {
 loki.source.journal "journal" {
   path = "/rootfs/var/log/journal"
   labels = { job = "{{ env "DOMAIN" }}" }
+  relabel_rules = loki.relabel.journal.rules
+  forward_to = [loki.process.journal.receiver]
+}
+
+loki.relabel "journal" {
+  forward_to = []
+
+  rule {
+    source_labels = ["__journal__systemd_unit"]
+    target_label  = "unit"
+  }
+  rule {
+    source_labels = ["__journal_syslog_identifier"]
+    target_label  = "ident"
+  }
+  rule {
+    source_labels = ["__journal_priority_keyword"]
+    target_label  = "priority"
+  }
+}
+
+// drop network db stats (15-20% of kernel logs)
+loki.process "journal" {
   forward_to = [loki.write.loki.receiver]
+
+  stage.drop {
+    expression          = ".*NetworkDB stats.*"
+    drop_counter_reason = "networkdb_stats"
+  }
 }
 {{ end }}
 
-- 
2.54.0


From 49e3168ffe0fb2e3b4df6bdc2feb3b352bfdd218 Mon Sep 17 00:00:00 2001
From: Simon <s.thiessen@local-it.org>
Date: Thu, 17 Sep 2026 15:36:35 +0200
Subject: [PATCH 3/3] update alloy config version

---
 abra.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/abra.sh b/abra.sh
index f9f90b2..10aaa5c 100644
--- a/abra.sh
+++ b/abra.sh
@@ -10,7 +10,7 @@ export PROMETHEUS_YML_VERSION=v2
 export MATRIX_ALERTMANAGER_CONFIG_VERSION=v1
 export MATRIX_ALERTMANAGER_ENTRYPOINT_VERSION=v1
 export GF_ALERTS_NODE_VERSION=v3
-export CONFIG_ALLOY_VERSION=v2
+export CONFIG_ALLOY_VERSION=v3
 
 # migrates secrets from old names to new names by reading values from the
 # running containers on the server and re-inserting them under the new names.
-- 
2.54.0