Promtail config for syslog and extract labels from nginx logs

promtail.yml

---

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

client:
  url: http://192.168.50.10:3100/api/prom/push

scrape_configs:
  - job_name: syslog
    syslog:
      listen_address: 0.0.0.0:1514
      idle_timeout: 60s
      label_structured_data: yes
      labels:
        job: syslog
        tier: develop
    relabel_configs:
      - source_labels: ['__syslog_message_hostname']
        target_label: 'hostname'
      - source_labels: ['__syslog_message_app_name']
        target_label: 'appname'
    pipeline_stages:
      - match:
          selector: '{appname="nginx"}'
          stages:
            - json:
                expressions:
                  message: message
                  timestamp: '"@timestamp"'
                  req:
                  res:
            - json:
                expressions:
                  request_method: method
                  request_host: host
                source: req
            - json:
                expressions:
                  status_code: statusCode
                source: res
            - labels:
                request_host: ''
                request_method: ''
                status_code: ''