Processing Windows Events with Promtail pipeline stage

Question

I'd like to process incoming windows events with a promtail pipeline stage to change the key inside the json message from {"levelText":"Error"} to {"level":"Error"}:

- job_name: windows
  windows_events:
    use_incoming_timestamp: false
    bookmark_path: "./bookmark.xml"
    eventlog_name: "Application"
    xpath_query: '*'
    labels:
      app: win_event_log
  pipeline_stages:
  - json:
      expressions:
        level: levelText
  relabel_configs:
    - source_labels: ['computer']
      target_label: 'host'

I can see the events in Loki but processing within the pipeline stages does not apply.

Is there something wrong in my configuration or is a combination of windows events and pipeline stages not possible in general?

Answer 1

You need to select label with - labels:. This is my working config:

scrape_configs:
- job_name: windows
  windows_events:
    use_incoming_timestamp: true
    bookmark_path: "./bookmark.xml"
    eventlog_name: "Application"
    xpath_query: '*'
    labels:
      job: windows
  pipeline_stages:
  - json:
      expressions:
        level: levelText
  - labels: 
      level: